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Readers Data EXchange 

New COMPUTIST readers using Apple lis 
are advised to read this page carefully to avoid 
frustration when attempting to follow a soft key or 
entering the programs printed in this issue. 

What is a softkey, anyway? 

Softkey is a term which we coined to describe 
aprocedure that removes, or at least circumvents, 
any copy-protection on a particular disk. Once a 
softkey procedure has been performed, the re- 
sulting backup copy can usually be copied by the 
normal copy programs (for example: COPY A, 
on the DOS 3.3 System Master disk). 

Commands and control keys 

Commands which a reader is required to 
perform are set apart by being in boldface and on 
a separate line. The return key must be piressed 
at the end of every such command unless other- 
wise specified. Control characters are preceeded 
by "Ctrl". An example of both is: 
6 Ctrl P 

Type 6. Next, place one finger on the Ctrl key 
and then press P. Don't forget to press the return 
key. 

Otha special combination keyp>resses include 
Ctrl reset and open-apple Ctrl reset. In the for- 
mer, press and hold down the ctrl key then press 
the reset key. In the lajter, press and hold down 
both Ctrl and open-apple then press reset . 

2 



Software recommendattons 

The S tarter Kit contains most of the programs 
that you need to "Get started". In addition, we 
recommend that you acquire the following: 

• Applesoft program editor such as "Global 
5fogram Line Editor (GPLE)". 

•Assembler such as "Merlin/Big Mac". 

•Bit-copy program such as "Copy II Plus", 
"Locksmith" or "Essential Data Duplicator". 

•Word-processor (such as AppleWorks). 

•"COPYA", "FID" and "MUFFIN" from the 
DOS 3.3 System Master disk. 

Super lOB and Controllers 

This jxjwerful deprotection utility (in the 
COMPUTIST Starter Kit) and its various Con- 
trollers are used in many softkeys. (It is also on 
each Super lOB Collection disk.) 

Reset into the Monitor 

Softkeys occasionally require the user to stop 
the execution of a copy-protected program and 
directly enter the Apple's system monitor. Check 
the following list to see what hardware you will 
need to obtain this ability. 

Laser 128: Your ROM includes a forced 
jump to the monitor. Press Ctrl return reset. 

Apple II+, //e, compatibles: 1) Place an Inte- 
ger BASIC ROM card in one of the Apple slots. 
2) Use a non-maskable interrupt (NMI) card such 
as Replay or Wildcard. 

Apple n-f, compatibles: 1) Install an F8 
ROM with a modified reset-vector on the 
computer's motherboard as detailed in the 
"Modified ROM's" article (COMPUTIST #6 or 
Book Of Softkeys m ) or the "Dual ROM's" 
article (COMPUTIST #19). 

Apple //e, //c: Install a modified CD ROM on 
the computer's motherboard that changes the 
open-apple Ctrl reset vector to point to the moni- 
tor. (This will void an Apple lie warranty since 
you must open the case to install it.) 

Apple //gs: If you have the 2.x ROM, there is 
a hidden Classic Desk Accessory (CDA) that al- 
lows you to enter the monitor. In order to install 
the new CDA, you should enter the monitor 
(CALL -151) before running any protected pro- 
grams and press # return . This will turn on two 
hidden CDAs, Memory Peeker and Visit Moni- 
tor. Thereafter press openapple Ctrl esc to go to 
the Desk Accessories menu. Select Visit Monitor 
and there you are. Use Ctrl Y to exit 

Recommended literature 

•Apple n Reference Manual (or lie. He, etc.) 

•DOS 3.3 & ProDOS manual 

•Beneath Apple DOS & Beneath Apple Pro- 
DOS, by Don Worth and Pieter Lechner, from 
(Quality Software 

Typing Applesoft programs 

BASIC pn-ograms are printed in a format that 
is designed to minimize errors for readers who 
key in these programs. If you type: 

10HOME:REMCLEAR SCREEN 

The LIST will look like: 

10 HOME: REM CLEAR SCREEN 

Applesoft inserts spaces into a program list- 
ing before and after every command word or 
mathematical operator. These spaces don't pose 
a problem except when they are inside of quotes 
or after a DATA command. There are two types 
of sp)aces: those that have to be keyed and those 
that don't. Spaces that must be typed sqjpear in 
COMPUTIST as special characters (0). All other 
spaces are there for easier reading. 

NOTE: If you want your checksums to match, 
only type spaces within quotes or after DATA 
statements if they are shown as (0) charactors. 
SAVE theprogram at periodic intervals using the 
name given in the article. All characters after a 
REM are not checked by the checksum program 
so typing them is optional. 

Typing Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as 
source code. 

Hexdimips are the shortest and easiest format 
to type in. You must first enter the monitor: 
CALL -151 

Key in the hexdump exactly as it appears in 
the magazine, ignoring the four-digit checksum 
($ and four digits) at the end of each line. When 
finished, return to BASIC with: 
3D0G 

BSAVE the program with the filename, ad- 
dress and length parameters given in the article. 

Typing Source Code 

The source code is printed to help explain a 
program's operation. To enter it, you need an 
"Assembler". Most of the source code in older 
issues is in S-C Assembler format. If you use a 
different assembler, you will have to translate 



portions of the source code into something your 
assembler will understand. 

Computing checksums 

Checksums are 4-digit hexadecimal numbers 
which tell if you tjfjjed a program correctly and 
help you locate any errors. There are two types of 
checksimis: one created by the CHECKBIN 
program (for machine language programs) and 
the other created by the CHECKSOFT program 
(for BASIC programs). Both are on the "Starter 
Kit". 

If your checksums do not match the published 
checksums then the line where the first checksum 
differs is incorrect. 

CHECKSOFT instructions: Install Checksoft 
(BRUN CHECKSOFT) then LOAD your pro- 
gram. Press & to get the checksums. Correct the 
program line where the checksums first differ. 

CHECKBIN instructions: Enter the monitor 
(CALL -151), install Checkbin at some out of the 
way place (BRUN CHECKBIN, A$6000), and 
then LOAD your program. Get the checksums by 
typing the Starting address, a period and the 
Ending address of the file followed by a Ctrl Y . 
SSSS.EEEE Ctrl Y 

Correct the lines where the checksums differ. 

Writing to the RDEX editor 

RDEX (are-decks) stands for: Reader's Data 
Exchange. We jwint what you write. When you 
send in articles, softkeys, APTs, etc., you are sub- 
mitting them fat free publication in this maga- 
zine. RDEX does not purchase submissions nor 
do we verify data submitted by readers. If you 
discover any errors, please let us know so that we 
may inform our other readers. 

Remember that your letters or parts of them 
may be used in RDEX even if no t addressed to the 
RDEX editor. Correspondence that gets pub- 
lished may be edited for clarity, grammar and 
space requirements. 

Because of the great number of letters we 
receive and the ephemeral and unpredictable 
appearance of our volunteer staff, any response 
to your queries will appear only in RDEX, so it 
would be more appropriate for you to present 
technical questions to the readers and ask for 
their responses which will then be placed in the 
Apple-RDEX. 

How to get a free library disk 

Wheneverjwssible, sendeveiything on Apple 
format (5.25" - DOS/ProDOS or 3.5" - ProDOS) 
or IBM format (3.5") disks. Other formats are 
acceptable but there may be some delay as we 
look for someone to translate it for us. (If you use 
a 5.25" disk, when we print your letter, we will 
return your disk with the current library disk 
copied onto it.) Use whatever text editor you like, 
but tell us which one. Put a label on the disk with 
your name (or pseudonym) and address (if you 
want to receive mail). Don't reformat any pro- 
grams or include them in the text of your letter. 
Send Applesoft programs as normal Applesoft 
files and machine language programs as normal 



binary files. We have programs to convert them 
to the proper format for printing. If you are 
sending source code files, and you are not using 
the S-C Assembler, send them as normal text 
files. 

When to include a prhited letter 

Don't include hardcopy (printout) unless: 

a. You are writing about a bug or other printing 

error. 

b. You are writing to ask for help. 

c. You are answering another readers help re- 
quest. 

d. You are writing about your subscription or 
sending an order for back issues or software. 

Bugs, requests for help and answers to re- 
quests for help are bumped to the head of the line 
and go in the very next issue. All other letters are 
printed in the order that we receive them. 

Writing to get help 

When writing to request help, be sure to 
include ALL relevent information. The more in- 
formation you include, the easier it is to find a 
solution. There's an old saying that goes "A 
pwoperly framed question includes 90% of the 
answer". 

How to get mail 

If you are interested in receiving mail from 
other readers, be sure that we have a current 
address. If you use a pen name and want to 
receive mail, we need to have your address. Our 
readers privacy is important, so we will not print 
your address unless you specifically say too. 

How to write to RDEX authors 

When writing to one of the RDEX authors. 
Write your letter and seal it in an envelope. Put 
your return address, the authors name (as it 
qjpears in RDEX) and the correct postage on the 
envelope. Put this envelope into another and send 
it to RDEX. We will put the correct address on 
your letter and mail it for you. Check to the right 
of the authors name to see if the author is writing 
from a foreign country and includ the proper 
piostage. 

Help Line 

These readers have volimteered their time to 
help you. Please call only within the given time 
frames (corrected for your time zone). No collect 
calls. 

Jack Nissel (Disk Protection, 7-lOPM EST) 
(215) 365-8160 

Electronic Bulletin Board System (BBS) 

Dave Goforth is the sysop for the Computist 
BBS. The number is: (206) 581-9292. If you 
already have a User ID# and password, sign-on 
using the User ID#. If you are a new user, it may 
take a day or so to validate your new ID# and 
password. 



You have a LEGAL RIGHT 

to an unlocked backup copy 

of your commercial software. 



Our editorial policy is that we do NOT condone software piracy, but we do believe that users 
are entitled to backup commercial disks they have purchased. 

In addition to the security of a bachtp disk, the removal cfc<^y-protection gives the user the 
option of modifying prograrrts to meet his or her needs. 

Furthermore, the copyright laws guarantee your right to such a DEPROTECTED backup 
copy: 

..."It is not an infringement for the owner of a copy of a computer program to make or authorize 
the making of another copy or adaptation of that computer program provided: 

1) that such a new copy or adaptation is created as an essential step in the utilization of the com- 
puter program in conjunction with a machine and that it is used in no other manner, or 

2) that such new copy or adaptation is for archival pnirpMses only and that all archival copies are 
destroyed in the event that continued possession of the computer program should cease to be 
rightful. 

Any exact copnes p)repared in accordance with the p>rovisions of this section may be leased, sold, 
or otherwise transferred, along with the copjy from which such copies were pirepared, only as part 
of the lease, sale, or other transfer of all rights in the pvogram. Adaptations so pn-epared may be 
transferred only with the authorization of the coi)yright owner." 

United States Code title 17, §117 
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Editorial Message 

What's new? Well, take a look at the new 
cost of unclassified ads. In order to encourage 
you to sell some of that hardware that your not 
using, we've lowered the cost of unclassified 
Ads. Only 250 per line. So if you've got some 
stuff that you're not using anymore, now is the 
time to sell it. 

If anyone has a cracking card that they're 
not using, why not sell it to another reader. A 
lot of new subscribers don't have anything 
that they can use to force a jump into the 
monitor. 

Most of the regular readers are aware that 
Computist went bankrupt back with issue #44. 
That's when we started the all volunteer idea. 

Computist is operating under Chapter 1 1 
reorganization. It's time to present the plan 
showing how we intend to repay our creditors. 

We went to court in October but, as is 
typical with matters legal, the plan acceptance 
was delayed until December. 

I feel that we have a good plan and that it 
will be accepted. The only creditor giving us 
any trouble is the IRS. (Some say that they 
give everyone trouble.) If it comes down to a 
p-ssing contest, we are considering asking for 
donations to pay the IRS and take them off the 
creditors list. I'd like to know how you feel 
about that. 

In any case, I'll know more by the 5th of 
December and I'll give a complete update on 
what goes on. 

So hang in there! And find some more 
subscribers so we can hire a full time editor. 
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RATINGS 

Superb "lAnAr^Ar^AnAr 

Excellent '^ik^^ 

Very Good 'A^^ 

Good ** 

Fair * 

Poor © 

Bad €)© 

Defective ^ 

One More Time?! 

After four years of minimal 'gs support, 
Apple's Consummate Enlightened One has is- 
sued an inCider encyclical assuring 11 users of the 
company's continued commitment. The letter 
mentioned such worthwhile achievements as an 
improved operating system and the imminent II 
HyperCard (but neglected to specify where the 
company had been committed or how long the 
treatment is expected to last). Fine; but, why 
now? 

If letters, BB postings, etc. are any indication, 
many 11 partisans believe the explanation is to be 
found in continued 'unstoppable' PC market 
share advances. Supposedly, The Computer 
Company MUST play its 'II card' yet one more 
time or face extermination. 

In the best of all possible worlds. Big Green's 
new Macs would sell like hotcakes; AND a 
portion of the capital generated would go into a 
serious Il-based assault on the home/school 
market. (As even PC devotees will admit, the 
smugly confident PC universe could stand a good 
scare.) In the Real World, our experience has 
been that the level of attention to 11 user concems 
is inversely related to Mac success. Small won- 
der, then, that The C.E.O.'s latest proclamation 
resembles less an assuranceof support than atrial 
balloon. (Basically: "Just in case things really get 
bad; what will it take to jump-start your interest 
in Apple products?") Fair enough; and, it goes 
without saying, any trial balloon from the First 
Apple Lord merits a response. 

Dear C.E.O.: 

First comes THE upgrade; then, we can 
talk about HyperCards, frame grabbers, CD 
interfaces, Mac links, and other such embel- 
lishments. Our needs are modest enough; 
say an 8 MHz '816 motherboard with 2 megs 
of main RAM, 256K or so of sound RAM, 
and capabilities for 640 x 400 256-color graph- 
ics. By way of compensation, you are en- 
couraged to rip out the network of expen- 
sive, glitch-prone kluges designed to pro- 
mote He compatibility. (This should help 
with costs; and, you can always market a lie 
plug-in for old-II diehards.) An in-ROM '816 
BASIC would be nice; but, for now, an empty 
socket and a promise will suffice. 

Price is very important. Not only must 
the individual Ilgs owner be convinced that 
the upgrade represents a good buy; he/she 
must also believe that other Ilgs owners will 
feel the same. So far, my polling indicates a 
number somewhere around $300. Naturally, 
when we bring in our machines to buy the 
new board, we shall wish to keep our old 
boards.They're no good to you anyway, and 
will supply many experimenters with end- 
less hours of fun (to say nothing of generat- 
ing countless interesting articles for Apple 
user pubUcations). 

A tad costly? No doubt. Still, a few 
hundred mil to relnvigorate your Ilgs base 
and attract new buyers is a bargain. (Like, it • 
sure beats losing the whole ball of wax!) In 
return, we'll buy your products, enlist re- 
cruits, kick stock prices up ten or twenty 
points, and save dear old Apple — one more 
time. 

Your pal, 
Jeff 
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Softdisk 

*** 

$69.95/yr, $39.9S/6mo, $19.95/3mo 
for 64K Apple n series 

Softdisk G-S 
*•• 

$89.9S/yr, $49.95/6mo, $29.95/3mo 
for 768K Ugs 

Like other II users, I appreciate such pubUca- 
tions as Nibble . inCider . A2 '. 8/16 . etc.. Being, 
however, 'the competition', none is likely to be 
reviewed here. ((Quoted, complemented per- 
haps; but not reviewed.) Softdisk Publishing's 
monthlies qualify as an exception, partly because 
they are "magazines on diskette", and partly 
because an editor seems to have taken the im- 
usual step of supplying Computist with a pair of 
subscriptions! 

The 'old timer' of the family is Softdisk (for 
n-t-/IIe/nc/Laser), in publication since 1981! It 
comes on one 3.5" or two 5.25" ProDOS disk- 
ettes and supports mouse, KB, and joystick in- 
puts. Softdisk G-S is an entirely separate, much 
newer enterprise. Currently at issue #11, it ar- 
rives on one 3.5" diskette; and a GSOS System 
Disk is included with the start of a subscription. 
Whichever 'flavor' youchoose, each month you'll 
receive content-labelled diskettes accompanied 
by a contents sheet to help with archiving. The 
publisher also sends a back issues catalog and, 
more likely than not, will include a "Premium 
Graphics" diskette or similar goodie to sweeten 
the deal. 

A Softdisk reads much like a "real maga- 
zine", even down to pages you can turn with a 
click on a screen comer (or, you can click a menu 
item and zip to any feature in a flash). Once past 
the cover graphic, you find the expected table of 
contents, readers' letters, commentaries, game 
and applications hints, news, know-it-all cor- 
ners, and reviews — all highly legible, with text 
highlighting, and spiced with graphic inserts. A 
typical Softdisk issue fills most of available disk- 
ette space; but only a relatively small share is 
allocated to editorial content, (i.e. an issue will 
seldomofferalloftheforegoingfeatures.)Though 
well written and fim to read, columns are much 
curtailed vis-a-vis print media cotmterparts. 

Most of each issue's space goes to two or 
three programs along with such extras as Print- 
Shop graphics, CDA's, game add-ons, and songs. 
For example, Softdisk #106 boasts a nifty (near 
Infocom-grade) Text adventure called "Amuse- 
ment Park", two classy crossword puzzles, a 
TXT/AWP file chopper utility, 28 PrintShop 
graphics (with Viewer utility), a numeric version 
of "Mastermind", and a for-real Checkbook 
Balancer! SoflDiskG-S#ll offers "Parashooter", 
an Invader-type arcade, Halloween/Thanksgiv- 
ing clip art, a new font and stationery templates 
for Awks GS, Pirates Cove course for Mean 18, 
a new levels set for Arkanoid 11, PrintShop GS 
graphics plus viewer, and a screen saver initiali- 
zation file. Not bad; and, better yet, you startup a 
game, graphics viewer, jukebox, or whatever 
directly from the magazine's 'pages'. Once fin- 
ished, you're back, ready for the next 'article'. 
('Help' for new readers, 'File Copy', and 'Dump 
contents to printer' are directly accessible as 
well.) 

Is Softdisk for you? That depends upon what 
it is you want in return for the publication ' s rather 
hefty dues. Product quality is usually very good; 
and, objectively, the programs, artwork, music, 
etc. represent a fine value. On the other hand, 
each month's offerings are 'pot luck'. A diskette 
filled with games and clip art in which you have 
zero interest is no "bargain software" v alue at all. 
Nor should users expect an exceptional learning - 
to-program-by-example opportimity; Softdisk 
does not include source files. (Too bad!! !) Con- 
tributors will, however, often list addresses and 
phone numbers to facilitate purchase of a 
program's source code, related products, and 
licenses. 



Softdisk and Softdisk G-S are, as advertised, 
chiefly "magazines" which do deliver a steady 
stream of tested, ready-to-go software. Some- 
times, you will find a 'real gem'; but the guaran- 
teed attractions are regular, hands-on experience 
with the creative activities of fellow 11 users, a 
potential market for your own products, and 
entertaining columns. No mag is always on- 
target (well, there may be ONE exception); but, 
each month Softdisk takes a pair of well-aimed, 
smooth-running shots. (Combined II + Ilgs trial 
subscription available at $39.95) 

USAGeoGraph 

MECC 

**** 

$139.00 for 768K Apple Hgs 

(Classroom Guide: $19.00) 

For teachers, students, and parents who ques- 
tion whether superior graphics 'really makes any 
difference' in educational software, this package 
from MECC should erase any doubts. Even with- 
out a 'must do by tomorrow' assignment, US A' 's 
crisp maps, color-keyed 'theme' highlighting, 
and 1 00-plus information items per state (and six 
territories) soon had me hooked. 'Finding out 
stuff can be fun, even addictive, when it's this 
easy! 



valuable addition, particularly since his Lawful 
Good alignment means that he won't turn tail or 
backstab your characters in the heat of battle.) 
Unfortunately, if he is in on the Temple of Bane 
mission, he will (according to the Clue Book) 
leave your party once the job is done. I happened 
to V isit the B ishop AFTER clearing B ane 's temple 
of evil doers and gromming the treasures (I had 
not, however, destroyed the alter); yet old Brac- 
cio made the same offer! Since there was a vacant 
character slot, I accepted and discovered that 
Dirten is perfectly willing to stick with the party 
to the end. 

II. New Alignments for Old 

Evidently, the fighter NPC's (non-player 
characters) you can hire at the Dueling Hall 
always come with a Lawful Evil alignment. To 
make this "Chaotic Good", change byte SD8 in 
the character's descriptor block from $02 to S06. 
(SCO for Lawful Good, etc.. The values follow the 
same order as the "Alignments" listing on page 5 
of the game manual.) If playing on a He, you can 
modify on-diskette character data (see T. 
Rapheld's article in Issue #70). 

On a Hgs, the easiest approach is to make 
changes directly to memory during play. Just 
install the Visit Monitor CDA (Call -151 and 
enter #) before booting. (Or, you can boot a 
diskette which installs DSR's Diversi Hack.) 
Once the game is running and you are walking 
around town, do an open apple Ctrl esc and select 
"Visit Monitor" from the Control Panel. Find the 
block for your NPC (e.g. "Hero") which should 
begin somewhere between $44(X) and $4F00 and 
enter the new alignment (e.g. $4AD8:06). This is 
also a good time to give your NPC a real name 
(e.g. replace "HERO" $4A00:48 45 52 4F 00 ... 
with $4A00:4D 4F 54 48 4E 4F 53 45 00 ... for 
"MOTHNOSE", etc.). Ctrl Y returns you to the 
Control Panel where selecting "CJuit" puts you 
back in the game. 

Note: Whenever modifying characters as 
above, be sure the target character is not cur- 
rently selected (e.g. being VIEWed, etc.) when 
you go to the control panel. The program main- 
tains a status buffer for a VIEWed character 
which, once you return to the game, may over- 
write any changes. Hence, the suggestion that 
you interrupt play while in 'Exploration mode' 
(movement using I, J, K, M keys). 

in. Super Weapon? 

Somewhere along the way, perhaps during 
the mission to clear the Valhingen Graveyard, I 
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Still, USA' is not merely a U.S. mini-atlas on 
diskette. It's a 'smart' mini-adas ready to setup 
and display all sorts of comparisons, generate 
charts and graphs as well as several different 
maps, AND help assemble and print reports! 
Even with user-friendly point-and-click access, 
learning to use these resources for 'real work' 
takes practice. To speed things along, USA"s 
attractive manual is thoroughly indexed and 
devotes half of its 190 pages to step-by-step 
tutorials. The optional looseleaf Classroom 
Guide adds stacks of lesson plans and handouts 
covering package introduction, U.S. geography, 
research topics, geography games, and more. 
(The 'Guide also includes lesson-to-chapter list- 
ings for several popular school texts and a teacher 
in-service presentation outline.) 

Supplied on two mini-diskettes with manual, 
backup diskettes, and Quick Reference cards, 
USA Geograph is as powerful as it is pretty. In 
school or at home, this could be the begiiming of 
a cure for today's all-too-pervasive 'geogrqjhy 
dunce-itis'i 

Fast Frames, Updates, Etc. 

Pool Cues 

For those enmeshed in SSI's "Pool of Radi- 
ance" here are a few droplets of information 
which may prove useful. 

I. The Bishop's Volunteer 

At some point you will visit Bishop Braccio 
(near the temple just east of City Hall). He will 
offer the services of a Level 6 cleric named Dirten 
who will join your party to help clean out the 
Temple of Bane. (Needless to say, Dirten is a 
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came upon a "-h2 Two-handed Sword". (The item 
went unnoticed until the usual post-mission visit 
to the Armor Shop, where a "Sell" check pro- 
duced an offer of 20,0004- gold! THEN I ob- 
served that the "+2" did not, as usual, follow the 
item name.) Tests indicate that it is not a sword or 
even a weapon. It is a magical artifact which 
grants a brief enormous increase in the USEr's 
hitpower — perfect for the big showdown with 
TheBoss. (Unfortunately, my experiments wasted 
the phantom sword's power. You, however, can 
be on the look-out for the item and put it to better 
use.) 

IV. Endgame 

Finally, you are dispatched (on a special 
mission from a councilman) to help the Forces of 
Good seize the Stowjanow Gates. After this 
success, you will be able to enter Valjevo Castle, 
wend and/or hack your way through a hedge 
maze, and take on The Boss in his two-story keep 
at the center. (See pictorial map on page 26 of the 
'"Journal".) 

Hints: In the first part of the 'Final Battle', 
feel free to unload all of your mass-destruction 
spells on the elite guards. (They aren't much 
good against The Boss anyway.) If you survive 
this fight, you'll have a chance to pick over some 
-h3 Rings of Protection, heavy-duty Plate Armor, 
and at least one -t-5 Long Sword. Be sure to try the 
new stuff here (i.e. TAKE and then VIEW/ 
READY items while checking changes in Armor 
Class and Damage). Immediately after EXTTing 
the TAKE routines, you will, at last, see the Pool 
of Radiance and face The Boss himself. One or 
two fighters armed with Fine (silver) Longbows 
and silver arrows are VERY helpful here. (Note: 
You will have to be a fast reader to catch all of the 
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message following victory. ALTERing speed to 
its slowest setting before the battles may be a 
good idea.) 

Adventure players accustomed to flashy dis- 
plays, parades, coronations and other such cele- 
brations are bound to find "Pool""s ending a tad 
underwhelming. Lest there be any doubt, once 
Phlan is cleared of The Boss and his major 
minions, the City Clerk will hand over a pile of 
gems, some fairly hefty Experience bonuses, and 
tell you that you have completed The Quest. 



double-hires scenes and effective use of win- 
dows. Where in Europe Is Carmen Sandiego? 

($44.95, for 128K Apple II) utilizes virtually the 
same format as earlier releases: Each caper 
launches you on a multi-nation chase guided by 
geography clues. One fairly important change is 
in the culprit I.D. clues (needed to obtain a 
warrant before you encounter the thief). These 
'slip in' some additional cultural learning via 
references to a suspect's favorite Books and 
Movies. A weakness is that the I.D. hints arrive 
as 'Telegrams", "Notes", etc. from the Chief, 
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KeefPC! 

After reading my Christmas Issue review of 
Keef the Thlef/gs, you, like trillions of other PC 
users, may have experienced the unusual emo- 
tion of feeling "left out". Take heart! Electronic 
Arts has released Keef/PC (640K) in VGA for- 
mat with AdLib music. For just $39.95 you too 
can become a juvenile delinquent, wander the 
weirdTri-City Area, and quest for Teenage God- 
Kinghood. 

Note: The manual's procedure for creating 
ready-to-play 5.25" diskettes brought Keef IPC 
perilously close to The Big Init. Assuming you 
have the usual 5.25 " + hard disk setup arid you 
would rather not spend an hour or so swapping 
diskettes (a couple hundred times), then forget 
about the manual. Instead, copy the originals to 
hard disk and run the installation from there to 
diskettes in drive A. When done, delete the origi- 
nals and, if you wish, move the new ready-to-play 
files to hard disk. 

Carmen x 3 
I. World •••• 

Broderbund's Where in the World is 
Carmen Sandiego?, a smash hit on the old 
Apple II, looks and sounds belter than ever in the 
Ilgs (512K) version. Featuring super-res scenes 
from 30 world cities and full gs sound, the game 
enlists you as an Acme Detective Agency sleuth 
just in time for a series of globe-spanning chases 
which turn out to be as entertaining as they are 
instructive. Carmen and her nine gang members 
axe snatching every national treasure in sight! On 
each assignment, your job is to utiUze geography 
and personality clues to track down and arrest the 
culprit. Success leads to progressively tougher 
challenges (e.g. less time, longer chases, etc.) 
and promotion — even a chance at the Detectives 
Hall of Fame! A consistent favorite (despite 
being "educational") among school-age visitors, 
the package includes the current 'World Almanac 
and Book of Facts and retails for $44.95. 



instead of coming from your investigations along 
with thief destination clues. Though the hunt 
seems a bit less realistic, the game remains an 
enjoyable route to learning about European 
geography. 

m. Time •••• 

For512K PC ($49.95,in CCA- VGA), Where 
in Time is Carmen Sandiego? moves the popu- 
lar learning game series and the elusive Carmen 
into historical realms. (Now you know why the 
Agency blew a bundle on that shiny new 
Chronoskimmer.)Naturally,nogreatmonument, 
relic, or other historical treasure is safe from 
time-transiting Carmen. Anywhere and any- 
WHEN (from 400 A.D. through the 1950's) she 
or one of fifteen new cronies is liable to gate-in, 
snatch a pyramid (a priceless suit of armor, the 
world's first mercury mine, etc.) and be off. 
Fortunately, beginning as a rookie Time Patrol- 
man assigned to track down each thief, you can 
depend upon a copy of the 'New American Desk 
Encyclopedia to help interpret historical clues 
(e.g. "She wanted to help Boris Gudonov spy on 
the Boyars.") and thief I.D. hints (e.g. favorite 
Author: "She bought some books by an exiled 
French writer."). Chronoskinuner destinations 
appwar as Country names plus highlighted Time- 
line. (To discourage excessive guessing, the same 
Country will sometimes appear twice with dif- 
ferent Time ranges highlighted.) The fattest 
Carmen package ever spans twelve countries, 
1 500 years, and packs more than a thousand clues 
relating to events, people, sites, and inventions. 
Smooth mouse action, beautiful VGA graphics, 
and good PC sound effects supplemented with 
AdLib music round out a challenging, highly 
entertaining learning experience. 

D&D Buglets 

By now, regular Computist readers are well 
aware that SSI's D&D stuff is riddled with as- 
sorted glitches. You do not, for example, always 
get a "KEEP" option when selling gems and 
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II. Europe i^-k 

Who knows? Maybe she made off with the 
prison — anyway. Carmen is loose again. This 
time she's gathered fifteen new henchmen and 
decided to celebrate "Europe '92" by specializ- 
ing. There's this neat tower in Paris, a nice zoo in 
Germany, etc., etc. . In fact, the national treasures 
of 34 European countries are up for grabs. Mean- 
while, back at Acme, the Chief has slapped the 
new Rand McNally Concise Atlas of Europe on 
your desk along with aninterpol dispatch. ("Gasp! 
Nobody could steal THAT!") Boasting colorful 
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jewelry; "Sell" sometimes switches to "Join"; 
occasionally, your inputs for Platinum to be 
Traded are ignored. Contributors have aheady 
noted that a few (non-critical) artifacts don't 
work as advertised; early adventures failed to 
warn that elves cannot be resurrected; etc.. To 
these you can add the absence of a map for Level 
3 of the Mines in the 'Silver Blades Clue Book 
(Level 1 is repeated) — all in all, fairly minor 
stuff which is 'nice to know about', but does not 
seriously impact enjoyment. ("Easy for you to 
say; none of YOUR characters is an elf! "True.) 



Returning to 'Silver Blades: if playing the PC 
version, there is at least one piece of documenta- 
tion which approaches bug-by-omission status. 
You may "Join" (copibine) spell scrolls into 10- 
scroU bimdles. This can easily put 20-30 major 
attack spells at the ready disposal of each magic 
user — a factor which drastically affects game 
strategy. Yet, the feature is mentioned only as a 
brief note on the last fold of the IBM "Data Card". 

In playing through all four of the TSR-based 
adventures, Idid encounter one potentially game- 
ruining bug in Champions of Krynn. Here the 
protection scheme uses references to passages in 
the'" Journal", insteadof an 'Infotator'-typecode 
wheel. The problem is that, perhaps once in every 
ten game starts, you will be asked to type in 
"Word #116 of Journal entry #207", etc.. Well, 
aside from the ridiculous requirement of count- 
ing 116 words, there is no Journal entry #207! 
With a little experimentation (you get three tries 
at the right answer), my dad and I came up with 
two words that seem to work most of the time: 
KNOW and HELP. (You may need to reboot 
once or twice to get a protection check which will 
accept one of these words.) Altogether (i.e. over 
the Ufe of the game), the bug probably cost me no 
more than four or five reboots. 

BASIC Power 

It isn't fair; but, if you are relatively new to 
personal computing, there's a lot of good, 'old 
stuff out there you may never hear about. 
("Everybody knows" about thus-and-such and 
"everybody uses" it; but does anyone tell you?!) 
Well, if you are still using Applesoft BASIC to 
write ApplesoftBASIC programs, you 're inluck! 
EVERYBODYKNOWS thatyoushouldbeusing 
Program Writer from Beagle Bros. According 
to the manual: "Program Writer runs on any 
Apple n+. He, He, IIc-i-, or Ilgs under both 
ProDOS andDOS 3.3 ."Basically, whatPWdoes 
is let you write your programs under a TEXT 
editor. Suddenly you can Renumber all or any 
block of lines, cursor among program lines and 
do effortless inserts and deletes, copy lines to and 
from a "clipboard", toggle 40/80 colimm modes, 
do a screen dump to your printer, and scroll up 



Earthquake (Volcano, etc.) attacks will usually 
win out. 

Papal Magnets: An easy victory may be yours 
if you can kill-off the enemy Shaman and sur- 
round the Evil Papal Magnet with water. The key 
here is your ability to defend the area long enough 
to build up settlements and push the frontier away 
from the M agnets (i.e. usually, your own Magnet 
must be nearby). If you can prevent rebuilding 
through the water barrier. Evil will be unable to 
create either Knights or a new Shaman! 

Romantic Encounters at the Dome irk 

(R-rating) 

The Dome, as everyone knows, is absolutely 
THE hottest singles spot in town! And, the an- 
swer to your first question is "Yes". The action in 
Microillusions' text-only encounters simulation 
($39.95, for 256K PC) can get a tad steamy— 
also seamy, humorous, 'meaningful', etc., etc. — 
or even leave you standing in the parking lot 
wondering how you blew it. From the moment 
you enter thecrowdedDomecomplex, 'Encoun- 
ters' aims to deliver realistic situations and out- 
comes based upon your al ter-ego ' s gender, mood 
(as "sensed" by the program from your inputs), 
"fate", and actions. With the exception of merely 
adequate parsing, there's a lot going for you, 
including good looks, smarts, and the opportu- 
nity to adopt godlike omniscience (i.e. there's a 
built-in cheat option!). Expect to be pleased, 
frustrated, disgusted, amused, and surprised. 
(Gosh, it sounds just like the real thing.) 

The Hunt for Red October € 

Okay, the new Russian super sub is SUP- 
POSED to be very quiet (at least, on caterpillar 
drive); and, in deference to the book/movie sce- 
nario, 'hot action' should be minimal. Even so, 
there must have been some "The Game" alterna- 
tive to this near-silent, strategy-oriented, SLOW 
submarine simulation from Software Toolworks 
($49.95, for 768K Ilgs). Just when you think 
good on-surface graphics and a thorough reading 
of the novel (supplied) might make a difference, 
ZABARROOM! soggy controls and weak in- 
strumentation finish the job. (Blurp, blurp,...) 
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AND down through the program Usting. Open 
Apple 1 -9 lets you hop quickly to distant parts of 
the listing. Finally, three commands (List Vari- 
ables, Find text, and Replace text) greatly speed 
such tasks as changing variable names, eliminat- 
ing all instances of imwanted CALLs and 
GOSUBs, etc.. There's more — for instance, you 
can usually exit the Editor, try out your program, 
and go back to editing without having to reload 
PW — but, you get the idea. ($49.95, supplied 
with manual on both 5.25" and 3.5" diskettes) 

The Codling's Advisor 

As a budding young demi-god in Electronic 
Arts' Populous, you are aU too aware of the 
obstacles to bringing the known universe around 
to the Path of EnUghtenment (i.e. under YOUR 
dominion). Here, therefore, are a few tips. 

Building: At the start of a campaign, it is 
frequently a good idea to wreck your own large 
buildings to more quickly free-up new settlers. 
(You can rebuild once the settlers are loose.) This 
tactic is particularly useful on slower-growth 
Snow & Ice landscapes. 

Flood: If your opponent has this power, you 
can bet that he/she will use it. Amazingly, some 
enemies will reel off a Flood even when most of 
the casualties are their own followers! Take the 
time to build at least two or three tiles above sea 
level. 

Knights: Bad news! If water is "Fatal", the 
best treatment for an enemy Knight is to unbuild 
to sea level beneath him. Otherwise, a decent 
defense consists of going to "Defend before 
build" mode and wrecking your own buildings 
when a knight approaches. This turns out more 
Good defenders and avoids littering your land 
with burned-out hulks. (Eventually, the knight 
will run out of hitpoints and you can quickly 
rebuild.) Against weaker opponents, it is often 
sufficient to go for an all-out building strategy, 
especially if the landscape is strung-out and/or 
broken-up. You will take some damage; but, the 
combination of steady power growth and your 



Slaying the Bug of Aragon 

Since SSI's new swords and sorcery war- 
game Sword of Aragon is best played from hard 
disk, it employs a documentation reference pro- 
tection scheme. You are referred to a poster (to 
identify a city picture) and then asked to type in 
a word from that city's description in the game 
manual (e.g. the first word under the "Resources" 
heading). Sometimes, however, the manual and 
program do not agree! In the few cases where this 
bug turned up, the solution turned out to be 
entering the SECOND word. (You get more than 
one try before things shut down.) 

Hints of Aragon 

The manual's observation that Mages are the 
most powerful "commander" characters turns 
out to be a gross understatement. Putting this in 
perspective: just three high- Level Mages can, via 
Teleport and Disintegrate spells, demolish the 
armies of an enemy city. "Mage" is your strong- 
est choice for the YOU character at the game's 
start because, being a mage, you can hire more 
powerful Mages. (As a Ranger, you could hire 
more powerful Rangers, etc.. Evidently, the for- 
mula is YOUR LEVEL x 0.40 = Max LEVEL of 
same type character you can hire. The multiplier 
is 0.35 for other types.) 

Thanks to sketchy game documentation, you 
might easily believe yourself stuck with every 
character (of random type and Level) who "of- 
fers to join your cause" upon an increase in Level. 
Not so! You must accept the character; BUT, 
using "Decommission", you can then boot him 
out to free-up the slot for a hireling of your 
choice. The manual also fails to note that, while 
"Hire" offers a character of the type you specify. 
Level is picked at random! You may go through 
any number of "Hire? Y/N" cycles in order to 
'fish' for the maximum Level obtainable. 

Though you can create several kinds of fight- 
ing units, three types seem to offer the best 'bang 
for your buck'. Infantry supplies hard-hitting, 
tough staying power; Bow units deliver long- 
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distance 'death from the skies' ; Cavalry provides 
high mobility for a quick, solid punch. A critical 
factor favoring mainly an Infantry-Bow mix is 
that, working together, the imits function well on 
both offense and defense. In selecting equipment 
for any imit expected to absorb hits, your best bet 
is to aim for the lowest Armor Class numbers 
obtainable. Minimizing unit losses is more im- 
portant than the small gains in range and hit 
power that come with better weapons and lighter 
armor. 

One large unit is, in general, more effective 
than several small units "stacked" on the same 
square. First, you are limited to sixty units maxi- 
mum; so they might as well be big enough to 
inflict serious damage. (Units you plan to tele- 
port must, of course, leave enough space for a 
Mage.) Second, an attack on a square hits each 
unit as though it were the only imit present! Lots 
of small, stacked units take much more total 
damage (lose more men) than one large unit 
when their square is hit. Conversely, your Bow 
units, spell casters, etc. inflict much heavier 
losses when hitting a square crammed with en- 
emy units. 

Due to a quirk in the game's tactical routines, 
enemy units (including Bowmen and Mages) 
tend to over-concentrate their attacks on your 
most advanced, visible unit. High-hitpoint Infan- 
try units belong at the front of any advance or in 
the most forward p)osition(s) when setting up a 
defense. 

Speaking of quirks, 'Aragon's manual ne- 
glects to explain what happens when the number 
and size of units you bring into a battle is too large 
for the number of setup squares allowed. What 
happens is that the program beeps and will not let 
you place the remaining imit(s)! If your natural 
response is (as it should be) to press ESC (instead 
of RESET), you will discover the way out. ESC 
tells the program to place a unit "at random". 
YOU cannot exceed square stacking Umits; but 
the program can and will, if it's the only way to 
place a unit. Once the battle starts, it's up to you 
to move over-stacked units into less crowded 
positions. 

It may be that you would like to play the game 
with less emphasis on managing city resources, 
(i.e. you would rather have more gold to build 
more units faster than the game normally al- 
lows.) In the PC version, games are saved under 
a letter name in four files. For example. Game 
"K" is saved in HIK, HRK, HSK, and HTK. To 
change "Wealth" (your gold) for a game saved 
under "A", just edit file HS A using "Xtree Gold" 
or some similar utility. The number (in decimal) 
for wealth should start around byte $1C-$1E. 
(Under "Xtree"', doing a VIEW in ASCII mode 
will show your Wealth a few lines above your 
home city name, " Aladda".) So, if current Wealth 
is -129.376, you can achieve a better cash flow 
situation by substituting something like 5 1 294.76! 

Once you have conquered Paritan, Char, 
Gemok, and Zamix, your holdings to the West 
are fairly safe and require very little defense. 
Good thing, because Gemok, Zamix, and Char 
each demand fairly hefty garrisons. Both Char 
and (once conquered) Dersh experience regular 
attacks from Giants and Titans. They must be 
taken and are probably worth holding (at least, 
until the Big Push against the Emperor). Neither 
city contributes much in terms of monthly in- 
come; but, precisely because of the frequent 
attacks upon them, they supply plenty of gold 
(from defeated monsters) and valuable Level- 
boosting experience for the characters and units 
who serve as defenders. 

Taking Medeval, city of the unfriendly East- 
em Elves, does not appear to be a condition for 
victory (unless you need the elven gold). On the 
other hand, this is probably the toughest, most 
interesting single battle of the game. It's nice to 
wind up with no city in imfriendly hands; but you 
can hit Medeval AFTER winning the throne. 

Naturally, you will want just about all of your 
stuff when you take on the Emperor's armies at 
Tetrada. A neat trick for speeding movement of 
infantry units on roads between friendly cities is 
to first sell-off armor and weapons. Each unit 
gains five or six movement points and can be re- 
equipped upon reaching the destination city. 
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Softkey for... 

Bank Street Writer Plus 
Broderbund Software, Inc. 

It was about two years ago that I purchased 
my first computer - a Franklin Ace 2200. Shortly 
after that, I purchased my first software. Bank 
Street Writer Plus. I was impressed with all of the 
features, which included a spell checker, thesau- 
ms, calculator, tutorial, 40 or 80-column format, 
etc. I was impressed all the way up until I tried to 
print something - a(id the Franklin hung. At- 
tempts to seek help from Broderbund and Fran- 
klin Computer prompted me to write my first 
article for Computist - warning potential Fran- 
klin Computer buyers of the problems in finding 
compatible software. 

To circumvent the problem, I wrote a utility 
that would print files created from BSW but my 
goal was to fix BSW so it would run on my 
Franklin. After months of trying to understand 
how it was copy protected, I finally gave up. 

Abwut six months later, I purchased a Laser 
128 (after making sure BSW ran on it). I was no 
longer concerned abouthow BSW was protected 
especially since Eric W. Taylorprovided a softkey 
which allowed me to obtain a backup copy of the 
disk (Computist #47). Then I purchased an 800K 
drive. I once again attempted to deprotect BSW 
so I could put the program, spell checker, and 
thesaurus on one drive and once again I was 
forced to admit defeat after months of trying. 
After reading through all of my BSW documen- 
tation, I found I could exchange one of my 5.25" 
diskettes for a 3.5" disk for a nominal S5.00 fee, 
which I did. The 3.5" disk is standard ProDOS 
format and the main program files can be copied 
to a ProDOS formatted 5.25" diskette and work 
just like the original protected 5.25" diskette, 
except it is de-protected. 

The Protection 

While attempting to obtain a working backup 
of Broderbund's "Prince of Persia", I began to 
notice many similarities between the two pro- 
grams. By boot code tracing both programs, 
allowing different portions of code to execute, 
then examining what was in memory, I made an 
interes ting discovery.Thereason these programs 
are so hard to de-protect, is because the track 
format is entirely different from any "standard" 
EXDS. The tracks are formatted to contain 18 
"sectors" per track - and a special loader is used 
to read the tracks. On entry to the loader, location 
SOOFE must contain the track to be read. Based 
upon parameters passed to the loader, the track 
value in SOOFE can be automatically incremented 
so it doesn't have to be specified every time. In 
addition, theparameters passed instnictthe loader 
as to where in memory the code needs to be 
loaded - whether it be main memory, auxiliary 
memory, or any of the four banks of the language 
card (banks 1 & 2 of main memory, as well as, 
banks 1 & 2 in auxiliary memory). In BSW, the 
loader is called via a JSR S2000 (Hex 20 00 20 in 
a memory dump). (In "Prince of Persia" the 
loader is located in the language card, and is 
accessed via a JSR SEEOO). It should be noted 
that all of this grief was caused by an individual 
by the name of Roland Gustafssoh - who proudly 
claims credit for his dispicable act by displaying 
his name when the loader is first invoked. You 
don't normally see it, since it is displayed on the 
TEXT screen while the HIRES screen is being 
viewed; however, it is there. If anyone knows this 
f)erson, I'd be obliged if you'd give him a punch 
in the nose for me! (Just kidding.) 

Anyway, back to how BSW is protected. 
When you boot BSW, the following happens: 

- Track SOO, sector SOO is read into S0800 and 
executed, which clears the TEXT screen, sets 



normal DOS hooks, then reads data firom track 
$00 into locations $1000-14FF and $2000-24FF 
then jtmips to $1300 

- The code at $1300 starts the drive, reads 
some values from the disk, does an Exclusive- 
OR to $1000-10FF based on data read from the 
disk - then jumps to $ 1 000 (It should be noted that 
this is where Eric W. Taylor determined what 
values were being expected and wrote his softkey 
to always supply the correct values.) 

- The code at $1000 sets the interrupt vector 
to get control if you try to break into the monitor 
via the system reset, vwifies the system is a lie or 
lie with 128K memory, reads tracks 2-5 into 
$4000-7CFF. displays the BSW logo, copies 
$4D00-51FF to $2500 - then jumps to $2500 

- The code at $2500 determines if the esc key 
was pressed and jumps to $271F if it was. If not, 
a sub-routine at $2573 is executed to load some 
common routines as shown below: 



Track 


Address 


$07 


OBOO-ODFF 




1100-lFFF 


$08 


4000^DFF 




7000-73FF 


$09 


7400-85FF 


$0A 


8600-97FF 



- Another check is made to see if the ESC key 
was hit - if so, control is passed to S271F. If not, 
loading continues. 

Track Address 

$0B 9800-A9FF 

$0C AAOO-BBFF 

$0D BCOO-BEFF 

0800-16FF (Aux) 
$0E 1700-lFFF (Aux) 

4200-4AFF (Aux) 
$0F 4B00-5CFF (Aux) 

$10 5D00-6EFF (Aux) 

$11 6F00-74FF (Aux) 

D000-DBFF(Bank2) 
$12 DC00-DFFF(Bank2) 

DOOO-DDFF (Bank 1) 
$13 DEOO-EFFF(Bankl) 

$14 FOOO-FFFF(Bankl) 

- Next, a sub-routine at $27B2 is executed to 
determine whether the 40 or 80-column version 
should be loaded. If a 4 was hit during the 
program load, a hex 28 (dec 40) is loaded into the 
A-reg, else a hex 50 (dec 80) is loaded for the 80- 
colunm version. Control is then passed to a sub- 
routine at $267B. This subroutine checks the A- 
reg and loads the requested version as follows: 

80-Column Version 



Track 


Address 


S15 


OEOO-IOFF 




4E00-5CFF 


$16 


5D00-6EFF 


$17 


6F0O-6FFF 




400041FF (Aux) 




40-Column Version 


Track 


Address 


$17 


OEOO-IOFF 




4E0O-59FF 


$18 


5A00-6BFF 


$19 


6C00-6FFF 




4000^1FF(Aux) 



- Next the loader is called to turn off the drive, 
some memory moves are performed, some code 
is copied to the keyboard buffer at $0200-02FF 
and then jumped to, which displays page 1 and 
then jumps to $4300, where BSW begins execu- 
tion. 

- If the esc key was pressed, to request the 
Utihty function, control was passed to a subrou- 
tine at $271F which loads the following: 

Utility 

Track Address 

$1A 0800-19FF 

$1B lAOO-lFFF 
6000-6BFF 

$1C 6C00-7DFF 

$1D 7E00-8FFF 

$1E 9000-AlFF 

$1F A200-AEFF 

$20 EOOO-FIFF (Aux) 

- Next the loader is called to turn off the drive, 
some memory moves are performed, code is 
copied to the keyboard buffer at $0200-02FF and 
then jtimped to, which displays page 1 and does 
a jump to $6200, where UTILITY begins execu- 
tion. 

The Softkey 

To deprotect BSW, you need two blank disks 
— one to hold de-protection utiUties and one for 
the captured program. During this softkey, these 
diskettes will be referred to disk A and disk B. 

1 . Make the following DOS changes. Note: These 
DOS changes were designed to work with both 
DOS 3.3 and Pronto-DOS. I recommend 
Pronto-DOS because it takes 1 min 40 sec to 
load BSW on DOS 3.3 and 25 sec with Pronto- 
DOS. 

CALL -151 

B6B6:60 00 86 09 

B617:B8 

B61A:B9 

B61D:B8 

B620:B9 

B62A:B9 

B62D:B8 

B632:B8 



B63A:B8 




B63D:B8 




B64B:B7 




B6F5:42 41 4E 4B 20 53 54 52 45 45 54 


B773:B8 




B784:B9 




B75E:03 




B715:03 




B71A:08 




B763:08 




B789:A9 00 8D EC B7 20 93 B7 60 




BFD3:EA EA EA (DOS 3.3 ONLY) 




9E42:34 




AEB3:10 




B3EF:29 




BEFE:29 




AEB5:A4 




2. Insert disk B. 




INIT BSW 




DELETE BSW 




3. Insert disk A. 




INIT HELLO 




DELETE HELLO 




4. Enter this binary code and save it on disk A. 


OAOO: 8D 08 CO AD SB CO AD SB 


$B1BC 


0A08: CO AO 00 89 00 DO 99 00 


$9219 


OAIO: 10 C8 DO F7 EE OD OA EE 


$40CB 


0A18: 10 OA AD OD OA C9 00 DO 


$3117 


0A20: EA AD 83 CO AD 83 CO B9 


$140A 


0A28: 00 DO 99 00 40 C8 DO F7 


$4590 


0A30: EE 29 OA EE 2C OA AD 29 


$FB8F 


0A38: OA C9 EO DO EA 8D 09 CO 


$FD8C 


0A40: AD 8B CO AD 8B CO B9 00 


$B438 


0A48: DO 99 00 50 C8 DO F7 EE 


$9276 



Readers Data Exchange 



0A50: 48 OA EE 4B OA AD 48 OA $A40D 

0A58: C9 00 DO EA AD 83 CO AD $4489 

0A60: 83 CO B9 00 DO 99 00 80 $06BB 

0A68: C8 DO F7 EE 64 OA EE 67 $5827 

0A70: OA AD 64 OA C9 EO DO EA $C956 

0A78: 8D 08 CO 8D 82 CO 60 $DD19 
BSAVE GET.LC, A$A00, L$7F 

9000: 8D 05 CO AO 00 89 00 90 $C2F7 

9008: 99 00 90 C8 DO F7 8D 03 $A46B 

9010: CO 8D 09 CO 8D 04 CO AO $954D 

9018: 00 B9 00 00 99 00 10 C8 $00F2 

9020: DO F7 8D 05 CO EE 18 90 $1FF8 

9028: EE IE 90 8D 04 CO AD 18 $C4B1 

9030: 90 C9 80 DO E4 8D 02 CO $6781 

9038: 8D 08 CO 60 $156C 
BSAVE GET.AUX, A$9000, L$3C 

5.Move the boot code from ROM to RAM and 

make some patches and save it. 
9400<C600.C6FFM 
94FA:93 

9301 :A9 92 8D 8E 08 4C 01 08 
9200:A9 91 8D 8B 13 4C 00 13 
9100:A9 90 8D 2F 10 4C 00 10 
9000:A9 8D 8D 5F 25 
900S:A9 82 8D 60 25 
900A:A9 CO 8D 61 25 
900F:A9 4C 8D 62 25 
9014:A9 59 8D 63 25 
9019:A8FF8D64 25 
901E:4C00 25 
BSAVE BSW.BOOT, A$9000, L$500 

6. Complete the patches. 
9600<9400.94FFM 

9000:A9 59 8D BO 27 A9 FF 8D B1 27 4C 00 25 

7. Insert the original BSW diskette. 
9600G 

8. Hit esc as boot starts to force load of UTILITY 
program. Wait until drive stops. 

ADOO<BF0O.BFFFM 

4000<9000.ADFFM 

9000<800.8FFM 

9.1nsert disk B. 

C600G 

CALL -151 

800<9000.90FFM 

2800<800.1FFFM 

BSAVE BSW.UTILITY, A$2800, L$6800 

10. Insert disk A. 
BRUN GET.LC 

11. Insert disk B. 

BSAVE UTLLC, A$3F00, L$200 

12. Insert disk A. 
BLOAD BSW.BOOT 
9600<9400.94FFM 

13. Insert original BSW diskette. 
9600G 

14. Wait until drive stops. 
7E00<8B00.BFFFM 
2000<9300.B2FFM 

15. Insert disk B. 
C600G 

BSAVE BSW.MAIN, A$B00, U8800 

16 Insert disk A. 
BLOAD GET.LC 
CALL -151 
AOOG 

17. Insert disk B. 
BLOAD UTLLC 

BSAVE BSW.LC, ASIOOO, L$8000 
DELETE UTL.LC 

18. Insert disk A. 
BLOAD GET.AUX 
9000G 

19. Insert disk B. 

BSAVE BSW.AUX,A$1000,U8000 

20. Insert disk A. 
BLOAD BSW.BOOT 
9600<9400.94FFM 

21. Insert original BSW diskette. 
9600G 

Type a "4" as the load starts to force load of 
40-colunm version. 

22. Wait until drive stops then insert disk B. 
C600G 

BSAVE BSW.40, A$EOO, L$300 

COMPUTIST #75 



BSAVE BSW.40A, A$4E00, L$2200 

23 Insert disk A. 
BLOAD GET.AUX 
CALL -151 
9000G 

24. Insert disk B. 

BSAVE BSW.40B, A$5000, L$200 

25. Insert disk A. Modify GET.LC to load the 
language card. 

BLOAD GET.LC 

A0D:10 

A10:D0 

A1B:10 

A29:40 

A2C:D0 

A37:2C 

A48:50 

A4B:D0 

A56:4B 

A64:80 

A67:D0 

A72:67 



26. Enter this code 

0800: A9 00 8D 
20 EO 



9E 
B9 4F 09 
F7 20 5D 
00 CO 8D 
03 4C 3C 
07 B9 55 
DO F7 20 
8D FF OA 
3C 09 C9 

AO AO 07 
AA 88 DO 
95 AO AO 
74 AA 88 
A9 00 8D 
8D F3 B7 
8D F4 37 
80 Fl B7 
03 EE ED 
E3 03 20 



0808: 
0810: 
0818: 
0820: 
0828: 
0830: 
0838: 
0840: 
0848: 

0850: 
0858: 
0860: 
0868: 
0870: 
0878: 
0880: 
0888: 
0890: 
0898: 

08A0: 
08A8: 
08B0: 
08B8: 
08C0: 
08C8: 
08D0: 
08D8: 
08EO: 
08E8: 

08F0: 
08F8: 
0900: 
0908: 
0910: 
0918: 
0920: 
0928: 
0930: 
0938: 

0940: 

0948: 

0950: 

0958: 

0960: 

0968: AE B4 

0970: BO CI 



and save it. 

FF OA AD 
20 95 AO 
99 74 AA 
A3 20 00 
FF OA C9 
09 20 95 
09 99 74 
5D A3 AD 
C9 9B DO 
B4 DO 11 



10 CO 
AO 06 
88 DO 
OA AD 
9B DO 
AO AO 
AA 88 
00 CO 
03 4C 
20 95 



B9 71 
F7 20 
07 B9 
DO F7 
EB B7 
A9 01 
8D ED 
20 E3 
87 CE 
D9 03 



09 99 74 
5D A3 20 
78 09 99 
20 5D A3 
8D FO B7 
8D EC B7 
B7 A9 87 
03 20 D9 
Fl 87 20 
EE ED 87 



CE Fl 
03 AO 
52 C8 
80 08 
EA AO 
54 88 
90 20 
09 99 
5D A3 
22 20 

09 99 
5D A3 
64 09 
20 5D 
99 00 
09 EE 
40 DO 
8F C8 
28 09 
EA 4C 

06 89 
DO F7 
C2 D3 

07 AE 
AE CD 



0978 
0980 



C2 DO 
CC CF 



87 20 
00 B9 
DO F7 
AD 80 
48 89 
CO FF 
95 AO 
74 AA 
AD FF 
95 AO 

74 AA 
20 95 
99 74 
A3 AO 
93 C8 
12 09 
EA B9 
DO F7 
AD 25 
00 43 

7F 09 
20 5D 
07 AE 
CI 05 
CI C9 
BO C2 
C2 03 
05 04 



E3 03 
00 85 
EE AD 

08 C9 
00 87 
DO F5 
AO 08 
88 DO 
OA C9 
AO 07 

88 DO 
AO AO 
AA 88 
00 89 
DO F7 
AD OF 
00 82 
CE 25 

09 C9 
20 95 



20 09 
99 00 
08 EE 
54 DO 
99 00 
20 00 
89 5C 
F7 20 
B4 00 
89 6A 



$07AF 
$24A7 
$1CEB 
$C002 
$80CD 
$87FA 
$4D31 
$8577 
$00EO 
$9504 

$56A3 
$0A8F 
$E845 
$3ED1 
$045A 
$A3C1 
$3F85 
$F8C8 
$851E 
$0678 

$60F7 
$7-7F3 
$4113 
$4E0C 
$61E4 
$9068 
$EF59 
$3B9C 
$4DAE 
$3D0E 



F7 


20 


$C978 


06 


89 


$71D9 


DO 


F7 


$86C7 


00 


20 


$D1A2 


EE 


OF 


$4FFC 


09 


C9 


$F885 


99 


00 


$D5F7 


09 


CE 


$07C3 


70. 


00 


$BAia 


AO 


AO 


$3D73 



CI C4 
BSAVE BSW, A$800, 

27. Enter the loader routine and save it. 



99 74 AA 88 

A3 4C 00 20 

CC C3 C2 03 

08 C2 03 07 

CE C2 D3 07 

03 07 AE 84 

07 AE B4 BO 

AE CI 05 08 
C5 02 
L$27F 



$0283 
$4F17 
$CD98 
$892C 
$6844 
$7147 
$BB38 
$6050 
$3F9C 



2000: 
2008: 
2010: 
2018: 
2020: 
2028: 
2030: 
2038: 
2040: 
2048: 

2050: 
2058: 
2060: 
2068: 
2070: 
2078: 
2080: 
2088: 
2090: 
2098: 



20 EO 
89 A3 
F7 20 
28 99 
18 20 
C9 20 
87 8D 
01 8D 
OF 8D 
87 20 



9E 20 95 
20 99 74 
50 A3 AO 



00 
EE 
DO 



08 C8 
IB 20 
EA A9 
FO 87 8D 
EC 87 8D 
ED 87 A9 
E3 03 20 



Fl 87 A9 
E3 03 20 
CE Fl 87 
DO ED AO 
00 AF C8 
EE 71 20 
DO EA 89 
C8 DO F7 
20 AD 87 
89 00 AD 



01 8D 
09 03 
AD Fl 
00 89 
DO F7 
AD 71 
00 40 
EE 84 
20 C9 
99 00 



AO AO OB 
AA 88 00 
00 B9 00 
00 F7 EE 
AD IB 20 
00 80 EB 
F3 B7 A9 
F4 87 A9 
3F 8D Fl 
09 03 CE 

ED B7 20 
EE ED B7 
87 C9 
00 34 
EE 6E 20 
20 C9 88 
99 00 
20 EE 
AE DO EA 
BF C8 OO 



33 
99 



90 
87 



$1E9E 
$F029 
$3E85 
$DC07 
$C6CF 
$5BC2 
$8081 
$6363 
$1EC1 
$9DA0 

$1173 
$5285 
$8C4A 
$AAE3 
$73DE 
$E163 
$82 6D 
$57A0 
$319C 
$3DC1 



20A0: F7 4C 00 62 C2 03 07 AE $37A4 
20A8: D5 D4 C9 CC C9 D4 09 S0271 

BSAVE LOADER,A$2000,L$AF 

28. Copy TRACK $00 from the original BSW to 
the de-protected disk. I used Copy II Plus 
sector copy but you could use Super lOB and: 

- LOAD SUPER lOB 

- EXEC FAST.CON 

- 1010TK=1 : LT=2 : ST=15 : LS=15 : CD=WR 

: FAST=1 
-RUN 

- Specify NO for FORMAT option 

or DISKEDIT and: 

- RUN DISKEDIT 
-RforRead 

- 01 1 for Track 01/Sector 1 
-E for Edit 

-0003 (Bytes 00-01) 

- Hit esc key 

- W for Write 

- Run original BSW and save defaults to our de- 

protected disk 

Details or Why I did what I did 

Step 1: 1 was unable to determine what code 
is responsible for saving default values to the 
program disk (from the UTILITY program and 



from the main program for default data, spell 
checker, and thesaurus drive locations). This 
code not only writes the information to the pro- 
gram disk, but first verifies that the program disk 
is in the drive. It does this by verifying two things. 
First, that BANK STREET is on track $00, sector 
$00, bytes $F5-FF. Second, that track $01, sector 
$01 contains 00 03 in bytes $0102. This step 
modifies DOS to write out the required BANK 
STREET identifier (and skips track $01 when 
writing DOS onto the disk) so it will be available 
for the BSW defaults. (Note: TheB ANK STREET 
identifier cannot just be changed via DISKEDIT 
because useful data resides in this location which 
must be relocated.) • 

The 9E42:34 indicates that the "HELLO" 
program is to be BRUN. The other changes 
modify DOS to format 40 tracks per disk. BSW 
has 18 sectors per track (2 more than DOS 3.3) 
which provides 68 extra sectors per disk - or the 
equivalent of 4.25 additional tracks. While I was 
able to identify, and eliminate some duplicate 
data, it wasn't enough to convert BSW to a 
standard DOS format, which requires 3 tracks for 
DOS and 1 track for a CATALOG, without 
adding additional tracks. This was not a problem 
on either my FrankUn, or my LASER 128 - but I 
know it's a problem on some older APPLE 11 
drives. If your drive cannot access 40 tracks, you 
will have to skip the last 4 changes in this step - 
and modify my procedure to save the UTILrTY 
program to another disk. The drawback to this, is 
that you will be required to maintain two sets of 
defaults - one on the UTILITY disk and one on 
the program disk - and/or modify the loader 
routines to request that the program disk be 
inserted prior to reading the defaults. 

Step 4: Create a program (GET.LC) to cap- 
ture the data in the language card. This is the 
source code: 

ORG 
STA 



LDA 

IDA 

LDY 

F1 LDA 



T1 



STA 
INY 
BNE 
INC 
INC 
LDA 
CMP 



BNE 

LDA 

LDA 

F2 LDA 



$C008 . main memory, zero page and 

language card 
$C08B select bank 1 . 
$C08B RAM for readings writing 
#$00 
$DOOO,Y read language card based on soft 

switches 
$1 000, Y save to main memo^ 

Fl 

F1+$2 
T1+$2 
F1+$2 



T2 



STA 
INY 
BNE 
INC 
INC 
LDA 
CMP 

BNE 
STA 



LDA 

LDA 

LDY 

F3 LDA 



have we copied from $0000- 

FFFF? 
F1 No - continue copy 
$C083 select bank 2 
$C083 RAM for reading & writing 
$DOOO,Y read language card based on soft 

switches 
$4000,Y save to main memory 



F2 

F2+$2 
T2+$2 
F2+$2 
#$E0 

F2 
$C009 

$C08B 
$C08B 
#$00 
$D000,Y 



T3 


STA $5000,Y 




INY 




BNE F3 




INC F3+$2 




INC T3+$2 




LDA F3+$2 




CMP #$00 




BNE F3 




LDA $C083 




LDA $C083 


F4 


LDA $D0OO,Y 


T4 


STA $8000,Y 




INY 




BNE F4 




INC F4+$2 




INC T4+$2 




LDA F4+$2 




CMP #$E0 



BNE 
STA 

LDA 
RTS 
END 



F4 
$CQ08 

$C082 



have we copied from $D000- 

DFFF? 

No - continue copy 

Aux memory, zero page and 

language card 

select bank 1 

RAM for reading & writing 

read language card based on soft 
switches 
save to main memory 



Have we copied from $D000- 

FFFF? 

No -continue copy 

select bank 2 

RAM for reading & writing 

read language card based on soft 
switches 

save to main memory 



have we copied from $0000- 

DFFF? 

No - continue copy 

Aux memory, zero page and 

language card 

select ROM for reading 

return 



Then create a program (GET.AUX) to cap- 
ture the data in Aux memory. This is the source 
code: 





ORG $9000 




STA $C005 select Aux memory for writing 




LDY #$00 


F1 


LDA $9000, Y copy this short 


T1 


STA $9000,Y program to Aux memory 




INY 




BNE Fl 




STA $0003 We are now executing this 




program in Aux memory 




STA $0009 select Aux zero page, stacK & 




language card 




STA $0004 select main memory for writing 




LDY #$00 


F2 


LDA $0000,Y read Aux memory 


T2 


STA jlOOO.Y save to main memory 




INY 




BNE F2 



STA $0005 


allow writing to Aux memory to 




modify pgm 


INC F2+$2 




INC T2+$2 




STA $0004 


switch back to writing to main 




memory 


LDA F2+$2 




OMP #$80 


have we copied from $0000- 




7FFF? 


BNE F2 


No - continue copy 


STA $0002 


back to pgm in main memory 


STA $0008 


back to main memory, page zero. 




stack, & language 


RTS 


return 


END , 





LP2 



Step5: Alter the normal boot process of BSW 
by dynamically altering code. First we copy 
BOOT from ROM (I can't do this - because my 
BOOT in both the Franklin & LASER 128 are 
non-relocatable - so I have to use a copy. See 
Computist #20 for BOOT disassembly.) After 
BOOT reads track $00, sector $00, a jump is 
normally made to $0801 . 1 don't want the normal 
code at S0801 to execute until I make some 
modifications, so I change it to a jump to $9301 
(with the 94FA:93). At $9301, 1 store a hex 92 
into $088E - which gives me control again, after 
the rest of track $00 is read, by changing the jump 
to $1300 to a jump to $9200. At S9200, 1 store a 
hex 91 into $138B - which gives me control 
again, after more data is read and $ 1 (MX)- 1 OFF is 
EOR'D with E7, by changing the jump to $1000 
to a jump to $9 1 00. At $9 100, 1 store a hex 90 into 
$ IC^F - which gives me control again, once all of 
the initialization has completed, by changing the 
jump to $2500 to a jump to $9000. The code at 
$2500, is the main routine for loading which 
program was selected, depending on what key 
was hit during the BOOT. Where the program 
normally gets setup to jump to $4300 to begin 
execute of BSW, I store: 

STA $0082 
JMP $FF59 

which ensures the ROM bank is active - then 
jumps to the monitor. I then save this to disk for 
future use. 

Step 6: Moves BOOT for execution and 
modifies BSW.BOOT to change the location 
being altered so a jump to the monitor occurs 
rather than the normal jump to the UTILITY 
program at $6200. 

Step 7: Execute our modified boot. 

Step 8: Relocate the UTILITY program so we 
can boot a normal DOS. 

Step 9: Boot a normal DOS. Compact the 
UTILITY program and save it to the deprotected 
program disk. 

Step 10-1 1: Capture the data in the language 
card banks and save part of it to the deprotected 
program disk. This part will be merged with the 
language card data captured from the BSW pro- 
gram. 

Step 12-15: Boot the original BSW disk to 
capture the 80-column program. If the default 
has been changed, you may need to type an 8 to 
force loading of the 80-column version. Relocate 
the BSW program in main memory to a safe 
location and boot a normal DOS. Save the BSW 
main memory to the deprotected program disk. 

Step 16-17: Capture data from the language 
card banks. Merge the UTILITY program lan- 
guage card data. Save the combined data to the 
deprotected program disk and delete the UTIL- 
ITY program language card data which is no 
longer needed. 

Step 18-19: Capture auxiUaiy memory data 
and save it to the deprotected program disk. 

Step 20-21 : Boots the original BSW program 
disk and loads the 40-column version. 

Step 22: Boot a normal DOS and save the 
main memory portions of the 40-column version 
to the deprotected program disk. 

Step 23-24: Capture the auxiliary memory 
portion of the 40-column version and save it to 
the deprotected program disk. 

Step 25: Modify the program that was used to 
capture the language card data, into one that will 
restore it 

Step 26: Create the program that will be 
executed when the deprotected program disk is 
booted. Save the program to the deprotected 
program disk along with the language card loader 
routine created in step 25. This program deter- 
mines what program was requested - and loads it. 
This is the source code: 

ORG $800 

LDA #$00 clear program 

STA $AFF type request flag 

LDA $0010 clear key 

JSR $9EE0 disable DOS hooks 

JSR $A095 clear filename 

LDY #$06 copy filename -BSW.LO 

LP1 LDA LC-1,Y tothe 

STA $AA74,Y filename buffer 

DEY 

BNE LP1 

JSR $A35D call BLOAD 

JSR $A00 load data into language card 
banks 

LDA $0000 Check for key hit 

STA $AFF save key hit 

CMP #$9B Esc key hit? 

BNE AAA No 

JMP UTL Yes - load utility program 

AAA JSR $A095 clear ilename 



BBB 
LP3 

000 
LP4 



F1 
T1 



F2 

T2 



LPS 



LP6 



DDD 

F3 

T3 



F4 
T4 



UTL 
LP7 



LDY #$07 copy filename -BSW.AUX 

LDA AUX-1,Y tothe 

STA $AA74,Y filename buffer 

DEY 

BNE LP2 

JSR $A35D 

LDA $0000 

STA $AFF 

OMP #$9B 

BNE BBB 

JMP UTL 

OMP #$B4 

BNE COO 

JSR $A095 

LDY #$07 



call BLOAD 

check for key hit 

save key hit 

Esc key hit? 

No 

Yes - load utility program 

4 hit? 

No 

Yes - clear filename 

copy filename - BSW40B 
LDA FORTYB-1 ,Y tothe 
STA $AA74,Y filename buffer 
DEY 

BNE LP3 

JSR $A35D call BLOAD 
JSR $A095 clear filename 
LDY #$07 copy filename - PUTAUX 
LDA PUTAUX-1,Y tothe 
STA $AA74,Y filename buffer 
DEY 
BNE LP4 



call BLOAD 

set volume # - matches any 
volume 

read entire sector 

set track # 

indicate read request 

set sector # 

set buffer address to $8700 
set RWTS input parameters 
call RWTS 
increment sector # 
decrement buffer address 
set RWTS input parameters 
call RWTS 
increment sector # 
decrement buffer address 
set RWTS input parameters 
call RWTS 



copy pgm 
defaults 



JSR $A35D 
LDA #$00 
STA $B7EB 

STA $B7F0 

STA $B7F3 

LDA #$01 

STA $B7EC 

STA $B7F4 

STA $B7ED 

LDA #$87 

STA $B7F1 

JSR $3E3 

JSR $3D9 

INC $B7ED 

DEC $B7F1 

JSR $3E3 

JSR $3D9 

INC $B7ED 

DEC $B7F1 

JSR $3E3 

JSR $3D9 

LDY #$00 

LDA $8500,Y 

STA $5200,Y 

INY 

BNE F1 

INC F1+$2 

INC T1+$2 

LDA T1+$2 

CMP #$54 2 sectors copied? 

BNE F1 No -continue 

LDY #$48 Yes -set to copy #$48 bytes 

from next sector 
LDA $8700,Y copy pgm 
STA $5400,Y defaults 
DEY 

OPY #$FF Done? 
BNE F2 No -continue 
JSR $9000 move code to auxiliary 

memory 
JSR $A095 clear filename 
LDY #$08 copy filename - BSW.MAIN 
LDA MAIN-1,Y tothe 
STA $AA74,Y filename buffer 
DEY 
BNE LPS 



relocate 
program code 



Done? 

No - continue 



JSR $A35D call BLOAD 

LDA $AFF load possible key value 

OMP #$B4 40-column? 

BNE DDD No 

JSR $A095 clear filename 

LDY #$07 copy filename - BSW40A 

LDA FORTY A-1,Y tothe 

STA $AA74,Y filename buffer 

DEY 

BNE LP6 

JSR $A3SD call BLOAD 

LDY #$00 

LDA $2000,Y 

STA $9300,Y 

INY 

BNE F3 

INC F3+$2 

INC T3+$2 

LDA F3+$2 

CMP #$40 

BNE F3 

LDA $B200,Y relocate 

STA $BFOO,Y program 

INY code 

BNE F4 

INC F4+$2 

INC T4+$2 

LDA F4+$2 

CMP #$7D Done? 

BNE F4 No -continue 

JMP $4300 jump to main BSW program - 

40 or 80-column 
JSR $A095 clear filename 
LDY #$06 copy filename - loader 
LDA L0ADER-1,Y tothe 
STA $AA74,Y filename buffer 
DEY 

BNE LP7 

JSR $A35D call BLOAD 
JMP $2000 jmp to the utility loader 

program 
ASO "BSW.LC" 
ASO -BSW.AUX- 
ASC "BSW.MAIN" 
ASO •BSW.40" 
ASC •BSW.40A" 
ASC "BSW.40B' 
ASO ■PUT.AUX" 
ASO -LOADER- 



LO 

AUX 

MAIN 

FORTY 

FORTYA 

FORTYB 

PUTAUX 

LOADER 

Step 27: Create the LOADER program which 
is used to load the UTILITY program into 
memory. This is the source code: 

ORG $2000 

JSR $9EE0 disable DOS hooks 

JSR $A095 clear filename 

LDY #$0B copy filename - BSW.UTILITY 



COMPUTISt#75 



Readers Data Exchange 



LP1 


LDA UTL-1,Ytothe 




STA $AA74.Yfllename buffer 




DEY 






BNE LP1 






JSR $A35D 


call BLOAD 




LDY #$00 




F1 


LDA $2800,Y relocate 


T1 


STA $800,Y 
INY 

BNE F1 
INC F1+$2 
INC T1+$2 
LDA T2+$2 


program code 




CMP #$20 


All done? 




BNE F1 


No - continue 




LDA #$00 






STA $B7EB 


set volume # - matcfies any 
volume 




STA $B7F0 






STA $B7F3 


read entire sector 




LDA #$01 






STA $B7EC 


set track # 




STA $B7F4 


indicate read request 




LDA #$0F 






STA $B7ED 


set sector # 




LDA #$3F 






STA $B7F1 


set buffer address to $8700 


F2 


JSR $3E3 


set RWTS input parameters 


T2 


JSR $3D9 


call RWTS 




INC $B7ED 


next sector 




DEC $B7F1 


next buffer 




LDA $B7F1 


load buffer address 




CMP #$33 


Are we done? 




BNE F2 


No - continue 




LDY #$00 




F3 


LDA $3400,Y relocate program 


T3 


STA $AFOO,\ 
INY 

BNE F3 
INC F3+$2 
INC T3+$2 
LDA T3+$2 






CMP #$BB 


Are we done? 




BNE F3 


No - continue 


F4 


LDA $4000,Y 


relocate program 


T4 


STA $9000,Y 
INY 

BNE F4 
INC F4+$2 
INC T4+$2 
LDA T4+$2 






CMP #$AE 


Are we done? 




BNE F4 


No - continue 


F5 


LDA $AD00,V 


relocate program 


T5 


STA $BFOO,Y 

INY 

BNE F5 






JMP $6200 


Jump to start of utility program 


UIL 


ASC "BSW.UTILITY- 




END 





Step 28: Provides three different methods 
which can be used to copy the default data from 
the original program disk to the deprotected 
program disk. 

Problems 

I used my deprotected BSW to write this 
article. Nearly everything appears to be working 
as it should. The one thing that is NOT working 
properly, is the function keys - just the ones 
displayed when you use APPLE-D. They are 
user defined Open- Apple 1-0 keys and Closed- 
Apple 1-0 keys. I've never used them - so I guess 
I didn't pay much attention to where they were 
stored in memory. All other "special" keys for 
spell checking, thesaurus, centering, printer 
control characters, etc. seem to work just fine. 

Additional Information 

The following is for those readers interested 
in more detail. 

- When the loader is called with a JSR $2000, 
the next byte after the JSR instructs the loader 
what subroutine is to be executed. It does this by 
taking the low order half of the byte (i.e., if the 
byte is hex C 1 it uses the 1 ) multiplies this by two 
with an ASL instruction - then uses this as an 
offset into a table of subroutine addresses. There 
are eight subroutines - 1 know what four do (for 
the most part). 

= Start drive 

1 = Stop drive 

2 = 7 

3 = Read entire track into consecutive pages 

starting with specified buffer address 

4 = Read sectors into specified buffer addresses 

5 = ? 

6 = ? 

7 = ? 

The best way to try and explain this is with 
some examples, so here goes... 

200020 -JSR $2000 

C3 - C=set to next track after read 3=read entire track 

03 - Read into main memory 

6C - Starting at location $6C00 

200020 -JSR $2000 

83 - 8=Don't change track 3=Read entire track 
83 - Read into RAM Bank 2 (8B is used for Bank 1 ) 
EO - Starting at location $E000 

200020 -JSR $2000 

C4 - C=set to next track after read 4=read into 

specified addresses 

83 - Read into auxiliary memory 

00 - Ignore this sector 

00 - Ignore this sector 

00 - Ignore this sector 

08 - Read sector into $800 

09 - Read sector into $900 
OA - Read sector into $A00 
08 - Read sector into $B00 
OC - Read sector into $C00 
OD - Read sector into $D00 
OE - Read sector into $E00 
OF - Read sector into $F00 

8 



10 

11 

12 
13 

14 
15 
16 



• Read sector 

• Read sector 

• Read sector 

- Read sector 

■ Read sector 

- Read sector 

■ Read sector 



into $1000 
into $1100 
Into $1200 
Into $1300 
into $1400 
into $1500 
into $1600 



10EF:D0 07 
10F1:CE C2 51 
10F4:D0 F2 
10F6:F0 2E 
10F8:AD 00 CO 



BNE $10F8 
DEC $51 C2 
BNE $10E8 
BEQ $1126 
LDA $C0OO 



200020 -JSR $2000 
01 - Stop drive 

BSW relocates normal DOS routines into the 
language card, and calls them from there. I'm not 
sure where all of the important locations are, or 
how they are accessed - but here is what I know. 
If you BLOAD BSW.LC - you'll be able to keep 
track of where I am. Starting at $1000 - is what 
was captured from the MAIN RAM - Bank 1 . 

SllOC/SDlOC = MYSEEK routine (located at 

SBESA in DOS 3.3) 
S1133/SD133 = SEEK ABS routine (located at 

SB9A0 in DOS 3.3) Moves arm to desired 

track 
S1372/SD372 = Desired track 
S135A/SD35A = Current track 
S 1373/SD373 = Arm Move Delay Table (located 

at$BAllinDOS3.3) 
S1385/SD385 = Arm Move Delay subroutine 

(located at SBAOO in DOS 3.3) 
$1398/SD398 = RDADR routine (located at 

$B944 in DOS 3.3) 
$143 1/SD431 = Sec torread (located at$B8DC in 

DOS 3.3) 
$1500/$D500 = Sector write (located at SB82A 

in DOS 3.3) 




NEWS 

David L. Goforth (sysop) 

Brian A. Troha 



Softkey for... 



Blockout 



Logical Design works/California Dreams 

Requirements: 

512KApple//GS 
3.5" disk copier 
3.5" disk editor 

LDW has released another fine program in 
it's California Dreams series, this one called 
Blockout. Blockout is a great 3D version of 
Tetris (Spectrum Holobyte). Like all other pro- 
grams from LDW, this one also contains a codew- 
heel type (copy) protection. Before you can play 
a game, the programs comes up with a block 
shape and asks what color is under a certain 
number. Then you must use the mouse to select 
that color. 

After a little brute force following of the 
program code I was able to come up with a bypass 
that completely skips the requestor screen and 
allows Blockout to boot right into the main menu 
of the game. To remove the CP do the following: 

1. Make a copy of the original Blockout game 
disk. 

2. Make the following edit to a copy ONLY: 

Blk Bvte Prom To 

$2B8 SlFB 22DD5A0O AFDD5A0O 

3. Write the edit back to the disk. 

Enjoy the newly deprotected Blockout. 

User #1082 

Softkey for... 

Classroom Toolbox (3.5") 

Sunburst 

I tried making a copy and booting it. After 
searching the all the drives, the program dis- 
played the message "UNABLE TO EXECUTE 
TOOL.S YSTEM". While examining the code in 
the area where the message was found I came 
upon this code: 

10ED;C9 FF CMP #$FF 

10EF:F0 07 BEQ $10F8 

10F1:CE C2 51 DEC $51 C2 

10F4:D0 F2 BNE $10E8 

10F6;F0 2E BEQ $1126 

10F8:AD 00 CO LDA $C000 

The protection was found in the fileTOOL.ST. 
It was found on block SF2 (242). I changed the FO 
07 BEQ $10F8 to DO 07 BNE $10F8. Now it 
looked like this: 

10ED:C9 FF CMP #$FF 



With this one byte change the copy protection 
was eliminated. 

Jack Moravetz 

Softkey for... 

Accelerated Reader v2.1 
Readup, Inc. 

The Accelerated Reader has a program disk 
and numerous data disks in a series to provide 
reading enrichment. The disks were copy pro- 
tected with the usual D5 AA 96 being changed to 
D5 D5 96. 

The author must be a COMPUTIST reader 
because I found a message on track SOO, sector 
$01 that said "You'll have to work at this a bit if 
you want to see it in Computist." I found another 
message on track $01, sector $08 that said "You 
know, you don't belong here! What's your ex- 
cuse for living?" He even left a message in an 
Applesoft program on the disk that read: 
1000 HOME 

1010 PRINT "Well, you've gotten this far. How far" 
1015 PRINT "can you go?" 
1020 PRINT 

1030 PRINT "Remember..." 
1040 PRINT " 'Wherever you go...there you are.'" 
1050 PRINT 

1060 PRINT "But it would be to your advantage to" 
1070 PRINT "GO to $C00firsL.." 
1080 PRINT 
1090 PRINT "A helpful hint from...Sergeant Schultz" 

Well, I'm sorry to disappoint the author, but 
removing the copy protection from this program 
didn't take very much work. After booting the 
program and resetting into the monitor with my 
Fingerprint-h card, I looked around the memory 
areas SB934 and $B954. Memory location $B95E 
had the values $C9 D5 instead of the standard 
EX)S 3.3 SC9 AA. On track $01, sector $09 I 
found where this was being changed. Begiiming 
with byte $28 it showed: 

A9D5 LDA #$D5 

8D5FB9 STA $B95F 

I changed the A9 D5 to A9 A A and wrote the 
sector back to the disk. I tried booting the disk and 
it booted successfully, but I ran into a problem 
when I tried to enter a name or teacher password. 
The disk would grind a bit and give me one of the 
program's error codes. I assumed that some code 
somewhere was still changing memory location 
SB95F, so I searched for 5F B9 on the disk. I 
found it on track $13, sector $0A. It looked like 
this: 

ADEE03 LDA $03EE 

8D5FB9 STA $B95F 

It didn't matter what value from $03EE was 
being placed into $B95F because A A belonged 
there, so I changed the AD EE 03 to EA A9 AA 
and wrote that sector back to the disk. No w I had 
a completely functioning copy. 

Step-by-step 

1 . Run COPYA and when the drive stops, press 
control reset. 

RUN COPYA 

Ctrl reset 

CALL -1 51 enter the monitor 

B942:18 

B95E:29 00 

3I30G return to BASIC 

70 

RUN 

2. Copy the program disk and any data disks that 
you need. 

3 . Using a sector editor or disk search utility, scan 
for A9 D5 8D 5F B9 and change the D5 to AA. 
I found them on track $01, sector $09, bytes 
$28-2C. Write the sector back to the disk. 

4. Scan for AD EE 03 8D 5F B9 and change them 
to EA A9 AA 8D 5F B9. 1 found them on track 
$13, sector $0A, beginning with byte $60. 



User #1158 



Softkey for.. 



Silpheed GS 
Sierra 



Requirements: 

Sector Editor 

I see that Silpheed is on the most wanted list, 
and have come across a deprotect for it. I can't 
take credit for it, but I sure can pass it on! 
Especially as we need to shorten that most wanted 
list! 

Patch created by Mark de Jong 

Fellow Silpheed Addicts, I have written a 
patch to allow you to enter "GAME PLAY" 
without having to take the time to look up all 
those names of the enemy ships which are found 
in your Silpheed manual, when your computer 
asks you to do so. No w all you have to do is press 
"RETURN" when you get to the "Silpheed Flight 
School" screen. All you have to do is follow these 
simple instructions, and your all set. 

Note: Do not attempt to use this patch on your 



original diskette. Only use a copy of the program 
disk. 

1. Start up your sector editor and go to block 
$01DB (0475). 

2. Scroll to the END of the Block. You should see 
all the names of the enemy ships. 

3 . All you have to do is DELETE all the names by 
changing ALL the HEX values to 00. 

4. Save the BLOCK. 

Your finished, congratulations! If you want 
to, you can change: 

SILPHEED FLIGHT SCHOOL 

ENTER THE NAME OF THE ENEMY SHIP 

BELOW 

To whatever you want. You can only use 
UPPER case. All you have to do is go just above 
the enemy names which you just deleted. You 
will see: 

. .ENTER. THE. NAM 
E. OF. THE ENEMY. 
SHIP. BELOW . SI 
LPHEED FLIGHT S 
CHOOL 

Or something like that! Notice that SILPHEED 
FLIGHT SCHOOL is at the bottom of the list. 
Don't worry, its supposed to be that way. Now 
change it to what ever you want. Remember not 
to save it to the ORIGINAL copy. 

User #573 

©Can anyone help with these two: 

Barron's SAT v2.0 

Success With Reading by Scholastic. 

This B arron 's SAT is different from the one in 
Computist 25 on Page 13. It has 12 sides instead 
of 6. The formatting of the disks seem to be the 
same and the SIOB controller works but the 
program won't run. I think they added a nibble 
count check on track $0A. 

Success with Reading doesn't seem to be like 
any of the other Scholastic programs and I can't 
even get a Bit copy. Hope someone can help with 
these. 



Merlin MemLoc 



Canada 



Hardware Timing Problems (He) 

Ever since installing my Vulcan HD, about 
every 30th time I booted, my machine would go 
into Monitor Mode. My machine had never 
crashed like this before. It didn't happened often 
enough to be all that much trouble. Anyway I 
asked AE Tech supjwrt what could be done about 



D 



#2 SN74LS245 



#1 SN74F109 
SN74S109 



Aux Slot 



it. AE came back with the following suggestion 
and the two IC's. (I have a He, revision E mother 
board.) 

As supplied from Apple, IC chip #1 is proba- 
bly either a SN74F109 or a SN74S109. Replace 
it with the SN74AS109. IC chip #2 is a 
SN74LS245. ReplaceitwithafreshSN74LS245. 

AE says that replacement will help "timing 
problems". So far no crashes! You might cry this 
if you are having similar hardware problems. 

Also there were some defective fans that went 
out on some of the earlier drives. It seems they 
under torqued some of the screws. If you have 
one of these they will send you a replacement. 
Now if only that #@%& tech support line 
wouldn't ring busy for weeks at a time. 

Dan Reid fUser #9831 Canada 

Advanced Playing Technique for... 
Elite 
Firebird 

Following patches to the game can only be 
applied once the game is loaded and running, 
there is a checksum routine built into the program 
as it loads through the graphics page. Also they 
can only be applied to a kracked version. 

1 . Press Ctrl reset twice. 

2. Apply the following patches as you would like: 

$290:00-FF location in present Galaxy 
credits 
credits 



.S298:00-FF 
S299:00-FF 
S29A:00-FF credits 
S29B:00-FF credits 
$29C:00-FF 
$2A5:00-FF 
$2A6:00-FF 
$2A7:00-FF 
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fiiel (ie: $FF=25.5 fuel) 
cargo room (ie: $FF=255 tons) 
tons of Food 
tons of Textiles 

COMPUTIST #75 



3 . Combat Rating has to do with by tes $2D4-2D6 
andl'mnotsure how they calculate, butchang- 
ing these has an effect on your rating. 

4. $6E85G will restart the game. 

Note: It is best to press ctrl-reset from the 
screen of key-9. Also, somewhere around the 
"Rating of Competent", you will get a message 
from the NAVY asking you to go on a hunt and 
destroy mission, as I have not been able to com- 
plete this mission I don't know if you get any kind 
of bonus. To quickly give your char a Competent 
rating, edit S2D5:FF FF and soon as you land on 
another planet you get the mission. 

User #1082 

Softkey for... 
Reading Comprehension: Finding the 
Main Idea 
Morning Star Inc. 

The protection was found in a file called 
CHECKDSK.OVR on the two disks thai booted. 
I used BLOCK.WARDEN from ProSEL to fol- 
low this file. I found a 20 00 BF and changed it to 
E A E A EA and further in the file I found a BD 8C 
CO with some C9 FF's after it. I changed the BD 
8C CO to 1 8 60 E A and wrote the block back and 
it worked. 



Bitkey for... 



Mathosaurus 



Micrograms 

This four disk set uses a single load format, so 
it probably could be captured with a copy card. I 
used Copy ][ Plus to format 4 blank disks. I then 
used the manual sector copy in the bit copy 
section to copy all the tracks except track $01. 
Super lOB with a controller to copy all the tracks 
except $01 would also work. 

Surak TFF 



Softkey for... 



Task Force 



There are two levels of protection on the Task 
Force disk. The first level of protection is in- 
cluded in the file STARTUP.SYSTEM. The 
protection in this file is as follows: (With 
STARTUP.SYSTEM BLOADed at $2000) 

2262:20 00 BF JSR BFOO ProDOSMLI 
2265:80 80 ReadBlock 

2266;B4 0A 0AB4 check for bad, 

unformatted, or non- 
standard block on 
master disk) 
2268:08 PHP save carry flag 

2269:18 CLC 

226A:FB XCE native mode 

2268:2B PLP retrieve carry flag 

This routine can be disabled by eliminating 
the ProDOS MLI call and leaving the carry flag 
clear. 

The second protection routine loads at loca- 
tion 02/D3FD and is coded as follows: 

D3FD:A2FE01 LDX #01 FE 

D400:A0 00 00 LDA #0000 

D403:8A TXA 

D404:18 CLC 

D405:C8 INY 

D406:98 TYA 

D407:2A ROL 

D408:A8 TAY 

D409:08 PHP 

D40A:DD0098 CMP 9800.X 

D40D:D01E BNE 042D 

D40F:28 PLP 

D410:CA DEX 

D411:CA DEX 

0412:10 F1 BPL D405 

0414:18 CLC Protection passes 

master disk 

0415:60 RTS exit 

0416:29 FF 00 AND #OOFF 

0419:09 00 03 ORA #0300 

D41C:EO0O00 CPX #0000 

D41F:F0 03 BEQ 0424 

0421:09 00 80 ORA #8000 

0424:20 87 C9 JSR C987 

D427:A9 00 04 LDA #0400 

D42A:20 87C9 JSR C987 

D42D:28 PLP 

D42E:38 SEC Protection falls on copy 

D42F:60 RTS exit 

I don't understand how this routine works (I 
think it may be a nibble count), but it can be 
disabled by replacing the SEC instruction at 
D42E with a CLC instruction. 

There is a problem because this second rou- 
tine can't be found on the disk. Therefore it must 
be encrypted on the disk and decrypted at run 
time. The routine is, however, loaded in memory 
and decrypted prior to the execution of the first 
protection routine. This second protection rou- 
tine can therefore be disabled by modifying the 
first protection routine to install a patch at run 
time that disables the second routine by replacing 
the SEC instruction at SD42E with a CLC in- 
struction. 

After modification, the first protection rou- 
tine looks like this: 

225D:0AD0C JSR OCAD 

2260:38 SEC 

2261 :FB XCE 

2262:A918 LDA #18 a CLC instruction 

COMPUTlST#75 



2264:8F2ED402STA 02D42E patch a CLC over the 

SEC 
2268:EA NOP 

2269:18 CLC 

226A:FB XCE 16 bit registers 

226B:18 CLC protection pass flag 

The modification accompUshes two things. It 
disables the first protection check and it causes 
the first routine to install a patch at run time that 
disables the second routine. The second routine 
is patched after it has been decrypted and located 
in memory at address $02/225D at run time. 

Step-by-step 

The entire patch for the deprotection is ac- 
complished as follows: 
BLOAD STARTUP.SYSTEIUI, A$2000, TSYS 
2262:A9 18 8F 2E D4 02 EA 
226Brl8 
BSAVE STARTUP.SYSTEM, A$2000,E$2BAD, 

TSYS 

That's it! 

UNK 

Advanced Playing Technique for... 
Omega 



Getting Level "Omega" Clearance 

First off, you need to actually have an ID.Disc 
setup by the game - in other words, you've gotta 
be playing first. Next, enter "Design" and select 
Design Cybertank. Select "New" - you want to 
make a new one. Let's call it 'Target" 

Select "Chassis", and the worst of everything 
- don't bother with any of the "Special" gizmos, 
just with the other junk. If you have extra cash, 
leave it - you're building flie target for you to 
blow away. 

Select "AI" and enter the following: 
program 

turn left 1 

move forward 2 

turn right 2 

move forward 2 

branch to program 

"Authorize" this tank and save everything - 
select "ECM" so that everything gets saved. 

Nowbootyoifffile-copyprogram. Youshould 
make a copy of either your Omega 3.5 or your 
Omega "/system/" disk (the boot disk) — this is 
what we need to work with. 

In any case, select DELETE FILE or what- 
ever, and delete all the files from the "/system/ 
cetanks" directory (3.5": /o/dirl/cetanks/) — that 
WAS a list of the tanks that you're to go up 
against in Clearance Evaluation. 

Now select COPY FILE, and copy the 
"O.TARGET" (the sitting duck tank you just 
made) from your ID.Disc to the .../cetanks direc- 
tory. Copy it 7 more times - use "F2" "F3" etc as 
filenames when your copy program complains 
'cause of duphcate filenames. 

When you have 8 copies of "O .Target" (most 
renamed, of course), select RENAME FILES 
and change them to this list: 
BUSTER 
DINKY 
DUCKY 
EIDOLON 
INTREPID 
MIRAGE 
OGRE 
PANDA 

Check and double-check your work. If all 
looks good, boot the game. 

What happened, you say? Well, in the ../ 
cetanks subdir are the 8 tanks that the game 
throws at you for each level of clearance evalu- 
ation. PANDA is tough, and OGRE is impos- 
sible. So all you did was create a tank that travels 
in a drunk line and doesn't shoot back. 

The Siphon 

Advanced Playing Technique for... 
Wings Of Fury 

9 

Requirements: 

Apple Ilgs 
Diversi-Hack 

If you're like me, you like to play ][e/|[c 
games in high speed mode on the GS. Well, 
Wings of Fury will allow you to access the 
control panel and change the speed setting, but 
you will also have to switch back to slow speed 
before landing your plane for more bombs, re- 
pairs, etc. So, I figured, why not make the game 
so that you don't have to land all the lime., just 
give the game infmite planes and rockets/bombs/ 
torpedoes, and then all you have to do is crash and 
then take off again with a fresh plane! ! ! 

1 . Put Diversi-Hack into Memory. . 

2. Boot Wings of Fury and choose a level. 

3. When you are ready to take-off, go to the 
control Panel, choose Diversi-Hack and press 
M 

D1/4F88:00 
4FF0:EA EA EA 
AAAC:EA EA EA 
Q 



To return to the game, type return a few times. 

This Utde tip/nick will give you infinite planes, 
etc. You shouldn't have any trouble mastering 
the game now. Have fun! 

George Politis 



Playing Tip for... 



Deathlord 



Search Wakiza ruins for gold. Enter dungeon 
through secret door in northernmost swamp's 
east wall (must pass through swamp). Must be 
level 8 to survive. Don't fight anyone in the 
towns or palace because the guards will kill you. 
Buy you can search guest chambers in palace, 
Diamyo 's residence in Kawa and south of missile 
weapons shop in Tokugawa. 

James B. Simpson 



Playing Tip for.. 



Deathlord 



An excellent party: Samurai, Ninja, Shisai, 
Shizen, Genkai and Mahotoukai. At the start 
don't enter any locked doors. First-level charac- 
ters should explore the island of Kodan, but 
neither of the ruins. There's a dungeon there 
that's not on the map. In each new place inquire 
about these: dungeon, island, ruin, pyramid, etc. 
The other islands are not in the position shown in 
the map on the package. Don't explore dimgeons 
until your Shizen knows Kaeru. Before transfer- 
ring Wizardry II characters, use a dagger of 
change to produce a good Ninja. Use a dimimy 
disk while exploring the dungeons. Pitch camp in 
comers of motmtains. If totally lost, qviit and 
disperse, the reassemble and begin afresh at 
Kawa. 

Richard Rasmussen 

Playing Tip for... 

Might & Magic 

9 

A dead character may be resurrected by the 
fountains at C-1, 9, 14, and 8,14. After drinking 
from fountain, cast Raise Dead. These raise spell 
casting to level seven for one day or battle, 
whichever comes first. For experience points 
(after Sorcerer is at least level three), go to 
Wyvem's Peak at C-3, head east from C-3, 5, 2 
and you'll defeat wyv em's for2,500-5,000expe- 
rience points a shot, plus 900 gold minimum. 
Lightning bolts are very effective here. After all 
the battles, fly to E-1 and trade gold for experi- 
ence points in Dragadune. 

Steve Mead 

Playing Tip for... 

Might & Magic 

9 

For the solution to Og'schess problem, watch 
the Star Trek episode where the Enterprise goes 
to the galaxy's asylum world. The chess problem 
is used as a password. The hourglass (in the C64 
version) is at E-1. 

Yoshihiro Kobavashi 

Playing Tip for... 

Might & Magic 

9 

If key card is rejected, enter each of the five 
projectors once and try again. Access code for 
Cave of Erliquin is in 2,5 in Cave of Dusk. 

Shadow Force 

Playing Tip for... 

Prince of Persia 



This game is one of the best Ile/IIc games I 
have ever played. It combines action & adven- 
ture in a cinema-style view. If you have remem- 
bered in the ancient days, Mechner created Kare- 
teka, a karate style game with a cinema-style 
view that revolutionized games that we play 
today such as "Defender of the Crovm" & "Rocket 
Ranger". 

Notes 

Before we begin, let me introduce to you 
some basic techniques that should be used 
throughout the game: 

When jiunping, ALWAYS hold down the 
button. You will never know when you shall slip 
or fall short of the jump. Also, make yourself as 
close as possible to an edge before you jump so 
you can get maximum distance. 

When fighting, the most effective way is to 
use the standard block-and-hit technique. To do 
this, wait till the opponent strikes, block by 
pressing up, then immediately press the button 
and the character strike and get a better chance of 
hitting the opponent. 



Inspect every room for secret passages. There 
are many in this game and you will not be able to 
finish it without finding them. To find them, 
jump up and down to look for any floor passages. 
Jump up and hit the ceiling to look for any ceiling 
passages. 

Doors don't stay open forever. Once you step 
on a step-block, the doors will start to close. . . 
that is unless something is on the step-block. 

Leam to distinguish step-blocks from the 
floor. 

After you complete each level (after Level 2), 
save the game. When you die, restart by pressing 
Control-R and then press Control-L to resume 
yotjr game. This will allow you to save a lot of 
time considering that you WILL die. 

Don't be afraid to explore. In order to win the 
game, you must explore every detail of the game 
and not miss anything on any level. 

Hints 

Note: * means that there is an energy ex- 
pander on that level. 

Level 1 

Your first level is very easy. Get the sword, 
which is to the left from where you start and then 
go to the exit which just to the right of where you 
start. Practice your sword techniques on the guard. 
Remember to watch for unstable floors. 

Level 2 * 

Straightforward. Watch out for floor spikes. 
Bewareof the blue potion which willDECREASE 
your life count. There is an energy expander here 
so don't forget to get it. 

Level 3 * 

This will be one of the toughest levels. From 
where you start, go to the right and climb to the 
top using the center segment. Now, you mtist do 
a jump of faith to the right. You will find that 
there is a floor when you land. You will also 
discover a step-block which will open the gate far 
to the left. There is also a energy expander in the 
area to the right. When you are ready, jump on the 
step-block and BURN RUBBER to the left! You 
will have litde time before the door starts to close. 
Do a running jump over the large hole then one 
final jump near the door and hang on to that ledge. 
Hopefully, the door will almost be closed so you 
can pull yourself up. After that, it is very straight- 
forward. When you confront the "LIVE" skele- 
ton, keep hitting until it falls off the ledge. Then 
climb down after it and keep hitting it until it falls 
to it's doom. 

Level 4 * 

Very straightforward. Watch out for loose 
floors and be sure to get the energy expander. 
When you confront the mirror, you will have to 
execute a run-jump through it. You will pass 
through but your shadow will come out the other 
side and will create a lot of trouble for you. 

Level 5 * 

S Craightforw ard. There is an energy expander 
here but you will soon find out what will happen 
to it. You will have to experiment with this level 
before you can finish it. 

Level 6 

Sttaightforward. Beware of the master guard 
(he is fat) for he will slice you up if you are not 
good enough. At the end, your shadow wUl create 
mischief once more. . . 

Level 7 • 

You start out falling so press the button to 
grab onto the ledge. Continue onto the right until 
you reach the ledge with a large whole with 
another ledge far to the right. Climb down the 
ledge, fall, and grab onto the ledge. Continue to 
the right. If you can't continue, go back and fall 
down another ledge for it will lead you to the 
same place. When you drink the blue potion, the 
room will turn purple and you will turn green. 
Run off to the left and you will float slowly 
down. .. DO NOT go into tfie exit because their is 
an energy expander just to the right. 

Level 8 

Straightforward but very hard. Be quick but 
be patient for a friend of the princess will help 
you. 

Level 9 * 

If you drink the blue potion, your vision will 
be distorted. To return to normal, find another 
blue potion and drink it. Be sure to get the energy 
expander. 

Level 10 

You will have to knock out many ceiling and 
floor blocks. 

Level 11 * 

Very simple. Be sure to get the energy ex- 
pander. 

Level 12 

The last level. I will not provide you hints 
because it would truly take the fun out of the 
game. You must use skill, agility, strength, cour- 
age, and tmst to get past the level. 

If you're stumped on the shadow. Remember, 
your shadow cannot harm you in anyway. Al- 



Readers Data Exchange 



though it might seem to, it is really the sword that 
is harming you. Your shadow is merely a reflec- 
tion of yourself and hence will try to mimic you. 
If your completely stumped, the answer is to: 
(Note: to decipher, read every other letter) 

If you have seen Indiana Jones and the Temple 
of Doom, you will do exactly what Indiana did. 
You will have to do a jump of faith. Run as fast 
as you can (hehe) and jump off the ledge. If you 
believe enough, you will fall to your doom. If you 
do believe however, you will survive. Trust me, 
I died a lot because I didn't believe and I'm not 
lying. 

Continue on and you will do battle with your 
final opponent, Jaffar. 

UNK 

Playing Tip for... 

Defender of the Crown 



Pick a lord good at jousting, since sword 
fighting is easy. Conquer at least two territories 
before buying more men. Then forget the enemy 
territories, go straight for his castle as soon as you 
get a catapult. Seek Robin's help first. Attack 
Norman castles first. Always control territories 
bordering your castle. 

K.E.Nathan 

Playing Tip for... 

Wizardry IV 
Sir Tech 

To obtain a powerful sword, you need blood- 
stone (9E, 19N, 10D),Lander'sTurquoise(18E, 
ON, 9D), and Amber Dragon (19E. 14N. 8D). Go 
to 8E, 13N, 7D and use candle from Fourth 
Guardian to reveal secret door, then to 9E, 19N. 
Equip all three stones, then use their special 
powers and put each one on altar for choice of 
three swords. Blue sword (West Wind) gives 
chance of critical hit. Green sword (East Wind) 
does massive damage. Amber sword (Dragon's 
Claw) does severe damage and restores hit points 
(my favorite, since it enables you to choose an 
extra group of monsters for fighting abilities 
instead of Priests). 

Cyril Chong 

Playing Tip for... 

Wizardry IV 
Sir Tech 

To enter the closed off room in Ziggurat, 
defeat L-5 prisoner on level 5 and get the winged 
boots. Wear boots and invoke their power, and 
you can go through priest hole and get carrot. Go 
to the special room, face the wall and invoke 
carrot's power so you can jump over the wall and 
enter the chamber. Victory there yields an item 
needed in solving another puzzle. 

Brad Kinman 

Playing Tip for... 

Wizardry IV 
Sir Tech 

To open the Gates of Hell you need the candle 
(Level 1 0), chiles (after defeating the Beast at 9,8 
or 10,9) and a book. 

Bob Cherochak 

Does anyone know how to make Test Drive 11 
the Duel and/or Monte Carlo nm tinder GS/OS 
5.0.2? Is there a way to fix Battle Chess GS to be 
launchable from GS/OS 5 .0.2? Right now I have 
to Warm boot into ProDOS 8 and then launch 
Chess.System. 

xxxxxxx 

Reader Review for... 

Rastan 
Taito 

Rastan GS gets my highest rating for a variety 
of reasons, not the least of which is it's superb 
graphics and sound. Thegame plays very quickly 
and is quite entertaining. In a period of relative 
sloth among Apple developers (particularly for 
the GS), it is a rare joy to see such a good game. 
Taito has come through again. 

The Game is Hard drive installable, though it 
does poll to make sure the original Side 2 is 
present in the drive. It polls on every level. 
However, even before Rastan was available, 
several "kracks" were available. The best of 
these was posted on America Online and merely 
circumvents the check. The worst of these was 
done by someone named "Joe Hack" and in- 
cludes a couple of "pirate" screens and a whin- 
ning message about how unfair it was thai he had 
so much less time to "crack" it than anyone else. 
Since the deprotection seems to be quite simple 
(a bypass of the disk poll) this all seems rather 
unnecessary. 

There are four levels, each consisting of three 
separate areas. I would love to see a sequel to this 
game with 10 or so levels. Each has a stuiming 
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backdrop, new monsters intermixed with the old, 
and slightly different types of challenges. The 
graphics are the best I have seen on a GS game, 
and the game speed is quite fast. 

The game allows you three lives with a new 
one granted every 75,000 points. You are also 
allowed to continue your game up to six times for 
a total of 1 8 lives. The only drawback I can find 
is that is it possible to accumulate as many points 
as the heart desires on the first level. After I 
reached over 2,000,000 points on level one, I 
decided to go for LOW points in solving the 
game. 

The game can be made much more challeng- 
ing by NOT continuing a game. This makes 
achieving the final goal a near impossibility 
without actually standing around to get lives. 

In short, Rastan is everything a computer 
game should be, entertaining, thoughtful (not too 
thoughtful), full of action and more action. The 
implementation is superb (did I say that already?) 
and it is well worth the retail price of about 
S35.00. I would suggest buying this game and 
encouraging Taito to produce more games like 
Rastan that utilize the full capabilities of the GS. 

The Rumor Mill 

1 . CirTech is rumored to be coming out with 
a Mac compatible card for the Apple //gs for 
under S 1 000. Announcement of the new product 
is expected in December. The card will not re- 
quire Mac ROMs to be installed. It will use the 
65C816 in theligs as a co-processor and will run 
at speeds equivalent to the top of the line Mac 
ll's, however it will be compatible only with the 
Mac-H and SE (not the 68020 or 68030 machines). 

"I don't know if it's Art or not, but I like it." 

2. Pirate BBS's have already seen 
PipeDreamer and Space Ace (both for the Apple 
//gs). Space Ace is supposed to be nine (8()0K) 
disk sides, but not Hard Drive installable. Hope- 
fully there will be a patch in a future Computist. 

3. Rastan hit the boards a week before any of 
the local outlets even knew the games was avail- 
able. Maybe this will help convince software 
companies that copy protection is not only un- 
necessary but unproductive. I would suggest that 
people who like Rastan but don't like the protec- 
tion write Taito and let them know. 

4. Plans for Barbarian GS have been dropped, 
but Rescue Raiders GS is still being worked on. 
Rescue Raiders was one of my favorite //egames, 
so I would love to see a GS version of it. 

5. 1 put a call in to Origin Systems. The sales 
rep said they have had lukewarm response from 
dealers about plans to order a //gs version of 
Ultima VI, so have decided not to pursue it. I 
would suggest callmg Origin at (800 9994939) 
and complaining, as well as calling your local 
software outlet or mail order house and telling 
them to ask Origin to release Ultima VI for the / 
/gs. However, there was some mention made of 
Ultima VII being in the final stages of produc- 
tion. We might see it as early as fall '91. There are 
no plans to make any of the Ultima games for the 
Macintosh (besides the one that have been). 

6. I also put a call in to Broderbund about 
making a //gs version of Prince of Persia. The 
Tech I talked to said "No plans to support the GS, 
but letters, lots of letters, might help." Note he 
wasn't just talking about Prince of Persia, but 
about GS support AT ALL! I also called the 
Customer Service number (800) 521-6263 and 
asked about a GS version. I spent quite awhile on 
hold, but was eventually told, "There are no plans 
to support the GS." However, I was told I could 
get a 3.5" disk version of the game for $5 (free if 
I had a proof of purchase dated in the last 90 
days). 



Vincent Andrews 



WA 



Advanced Playing Technique for... 
Dungeon Master 
FTL 

Have you had the p»roblem of losing a charac- 
ter and you're nowhere near an Alter, can't throw 
a rock far enough because your characters aren't 
strong enough, or just plain tired of sleeping all 
the time to restore all characters health and mana 
points. Well, now you can change all of that 
anytime you want while you play. 

Dungeon Master CDA vl.l 

This version now scans for the 4-main charac- 
ters instead of going straight to them. I fouijd that 
people with hard drives, having RAM set, or 
anything else that required space in memory had 
problems with the earlier version (vl.O). Well, 
this version corrects that. 

Once you have the settings to your liking, you 
can now use it any time to restore lost health, 
stamina, and mana points by just pressing (N) to 
save. No more readjusting the values to the way 
you like it. 

This version allows you to change only the 
stats of the four characters you've chosen at the 
beginning of play . You can change Health, Stam- 
ina, Mana, Strength, Dexterity, Wisdom, Vital- 
ity, Anti-Magic, Anti-Fire, and restore charac- 
ters back to full health — even when Oiey arc 
dead. 

My next version will include a few items to 
equip your characters with. 



Instructions 

The first thing you need to do is make a 
workable backup copy of the original disk. Use a 
disk copier that can ignore bad blocks. Now copy 
the disk onto a formatted 3.5 diskette. You can 
use Photonix, Copy II Plus v8.0 or later, or Prosel 
disk copier. Now you need to bitcopy track 0, 
both sides, no synchronizing, and no nibble 
counting. I used Copy II plus. Now you need a 
disk editor such as Zap from Prosel or sector 
editor from Copy II Plus. Edit the following 
blocks: 

To restore the control panel 

BIk Byte From Jo 

1F8 86 12 13 

Or search for F4 12 00 D4 F4 D4 F2 A2 03 1 1 
and change the 12 to 13. 

To make^layabie 

Blk Bvte From To 

104 118 78C2 30 18 60F2 

Or search for 78 C2 30 8D C2 14 and change 
78C2 30tol8 60F2. 



Blk 
104 


Byte 
IOC 


From 
00 


To 
20 




114 


38 


18 



Or search for EO 00 00 FO 04 1 8 AB 2B 6B 38 
and change the first 00 to 20 and the 38 to 18. 

Finally, on the backup copy create a directory 
in the System folder named DESK.ACCS and 
copy the file DMASTER.CDA to that newly 
created directory. Should look like this when 
cataloged:/DUNGEON.MASTER/SYSTEM/ 
DESK.ACCS/DMASTER.CDA/ 

I hold the copyright to this program. You can 
upload this pffogram and its accompanied source 
code files to any BBS. The source code is there 
for people to look at and to get a few ideas on how 
to create and assemble binary programs. I ask 
you not to edit this program in any way except to 
help make it nm better. If you do, then leave the 
title as is. I have spent weeks gathering the 
information to create this little program. I would 
greatly appreciate it if everyone can spread this 
program and its accompanied source code files to 
every BBS around. 

If you have the chance, write to me telling me 
what you think of the program. I like to know ho w 
many people out there in the world is actually 
using my program. 

DGM.CMD.S 

* Linker.gs command file for Linking Dungeon Master 

* Batch asm part: 

ASM DMG.ASM ;Only one module 

* Linker part: 

VER $1 ;Link to OMF version 1 

KND $20 ;No spec mem 

;(UseKND $1000 for ver=2) 
TYP $B9 ;Make CDA type file 
LINKDMG.L ;Only one link file 
SAVEDMASTER.CDA 
END ;Optional 

LSI OFF 
EXP OFF 
TR OFF 

DMG.ASM.S 

* DUNGEON MASTER 
'CHEAT vl.l 

* A classic desk accessory 

* Vince C. Andrews 10 Aug 90 

* Merlin-16+ Assembler 

DATE 

PEL 

N EQU 

Y EQU 1 

n EQU 

y EQU 1 

SAVOBJ KBD "Save object code? (Y/N)" 

DOSAVOBJ 
DSK DMG.L 
FIN 

XC ;65C02 mode 
XC ;65816mode 

* Zero page loc saved and used as well as other locations: 

PNT = $E0 ;AlsoE1,2,3 

CH = $000024 ;Horizontal Cursor Position 

CV = $000025 ;Vertical Cursor Position 

TABV = $E0FC22 ;Set Vertical Cursor Position 

KYBD = $E0CO0O iGetkey 

STROBE = $EOC010 ;Clear Keyboard Strobe 

NAMEA = $020508 ;Bank address to begin 

NAMEB = $0208E7 ; searching for characters 

NAMEC = $020C06 

NAMED = $020F25 

USE DMG.MACROS 

* Required stuff of all CDA's: 

■ The string is what goes on the 

* Control panel listing. 

BEGIN STR 'Dungeon Master Cheat' 

ADRL START ;Entry point address 



ADRL EXIT 



MX %00 



;Exit "routine" address 
; (just an RTL). 
lEnters in fuir 16-bit mode 
; so better tell asm that. 



* 


BRA HEaO 


* This is 

* 


the QUIT ROUTINE 


QUIT 


CLC 




REP %001 1 0000 ;1 6-bit mode 




PLB ;Restore data bank to original 




PU 




STA PNT+2 




PU 




STA PNT 


EXIT 

* 


RTL 


• Continue with the program 

* 


HELLO 


SEP %0011 0000 ;8-bit mode 




JSR NAME ;Scan & Print names. If invalid 




characters were found then 




the next name will be printed. 


JHELLO 


PRINT 8D" Choose the character # to view/ 




edit or any other key to quit."8d 




GETKEY 




CMP rv 




BEQ 1H1 




CMP rr 




BEQ ]H1 




CMP #"3" 




BEQ ]H1 




CMP r4" 




BEQ ]H1 




BRL QUIT 



* Entry point when selected from Control panel: 

START PHB ;Save current data bank 

PHK ;Get our bank 

PLB ; and set data bank to it 

PEI PNT ;Save the 4 zp Iocs we use. 

PEI PNT+2 ; and zero the bank byte for 

STZ PNT+2 ; long addressing 



Readers Data Exchange 



]H1 STA CHAR 

JSR COPYGP ;Copy game into editor area 
BRL EDITOR 

* This is the PRINT TITLE SCREEN 

TITLE PRINT 8C8D 
LINE 
PRINT 8D" DUNGEON 

MASTER Cheat v1.1"8D 
PRINT " by Vincent C.Andrews 

10Aug90"8D 
LINE 

PRINT 8D 
RTS 

* The Name Routine Display 

t 

NAME JSR TITLE 

LDX #$0 ;lnitialize X-reg. 
STZ XXX ;Zeroxxx&xxx+1 
STZ XXX+1 

]AGAIN REP %0011 0000 ;1 6-bit mode 
LDX XXX 
INX 

BNE ]LUP1 ;Branchifnotzero 
BRL FAILED 

]LUP1 STX XXX ;Stay X-reg. at XXX 
LDALNAMEA,X 

SEP %001 1 0000 ;8-bit mode & no Hi-byte 
CMP#$4C 

BEQ ]CHECK2 ;Branch if match 
BRA JAGAIN ;Go and check for next byte 

]CHECK2 REP %00110000;16-bitmode 
LDX XXX 

INX ;lncrease XXX 

BNE ]LUP2 iBranch if not zero 
BRL FAILED 

)LUP2 STX XXX ;Stay X-reg. at XXX 
LDALNAMEA,X 

SEP %00110000;8-bit mode & no Hi-byte 
CMP #$21 

BEQ ]GOOD ;Branch if match 
BRA JAGAIN ;Go and check for next byte 

JGOOD REP %001 1 0000 ;1 6-bit mode 

LDX XXX ;LoadXXX 
INX Jncrease X-reg. 

INX ; Increase X-reg. 

STX FOUND ;Put X-reg in FOUND 

SEP %001 1 0000 ;8-bit mode 

* 

PRINT 8D- 1)- 
>» PRINTY.NAMEA 
PRINT 8D" 2)" 

»;> PRINTY.NAMEB 
PRINT 8D" 3)" 
>» PRINTY.NAMEC 
PRINT 8D" 4)" 
>» PRINTY.NAMED 
PRINT 8D 
LINE 
RTS 

FAILED SEP %0011 0000 ;8-bil mode 

PRINT 8C8D8D" This editor could not find 

what it was looking for." 
PRINT 8d" Are you sure the Dungeon 

Master game is loaded in memory?" 
GETKEY 
BRL QUIT 

* This routine will print the name of the character 

* 

CHNAME LDY CHAR 
CPY #"1" 
BEQ JCHNAMEI 
CPY #"2" 
BEQ 1CHNAME2 
CPY #"3" 
BEQ 1CHNAME3 

>» PRINTY.NAMED 
RTS 

JCHNAMEI >» PRINTY.NAMEA 
RTS 

1CHNAME2 >» PRINTY.NAMEB 
RTS 

]CHNAME3 >» PRINTY.NAMEC 
RTS 
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• This is the PRINT MENU SECTION 

MENU JSR TITLE 
PRINT 8D" 
JSR CHNAME 
PRINT 8d8cl- A) Health: 

Fighter:" 
PRINT 8d' B) Stamina: 

Ninja:" 
PRINT Sd" C) Mana: 
PRINT 8d" 

PRINT 8d" D) Strength:" 
PRINT 8d" E) Dexterity: 

Save" 
PRINT 8d" F) Wisdom:" 
PRINT 8d- G) Vitality: 

Character" 
PRINT 8d" H) Anti-Magic:" 
PRINT 8d" I) Anti-Fire:"8d 
LINE 
RTS 

* This is your EDITOR PROGRAM 
EDITOR JSR MENU ;Print the MENU 



K) 

L) Priest:" 
Wizard:" 

N) 



0) Next 



HVTAB#45;#11 ;Priest 

PRINT " 

HVTAB#45;#11 ;Priesl 

LDY #8 

JSR PRINTCL ;Check for level 

HVTAB#45;#12 ;Wizard 

PRINT " 

HVTAB#45;#12 ;Wizard 

LDY #12 

JSR PRINTCL ;Check for level 

HVTAB#1;#21 

PRINT " Choose a number to change or 
ESC to quit 



WIZARD JSR CHANGE 
PRINT "Wizard:" 

LDY #12 ;We are doing Wizard 
BRL CHCL 

SAVEIT JSR COPYPG ;THIS WAS JSR TO 

SOMETHING THAT DIDN'T 
BRL HELLO ; RETURN WITH AN RTS 

* Miscellaneous routines 

* PRDEC & PRDEC16 are 2-byte decimal output routines. 

* PRDEC enters with short A,X and prints A hi, X low. 

* PRDEC18 enters with long A and prints A. 



jSKP 
1D0NE1 



BCS ]SKP iBranchifset 

CMP #$41 

BCC ]D0NE1 iBranch if less than 

CMP#$5B 

BCS ]D0NE1 ;Branch if greater than 

CLC 

JSR COUT 

RTS 



]LUP 



EDIT0R2 



]LUPA 



]QUITA 



CLC 

HVTAB #21 :#9 
PRINT " " 
HVTAB #21 ;#9 
LDX AA 
LDA AA+1 
PRDEC 



;Health 



;load low 

itoad hi 

iPrint Decimal of two byte 

location 



HVTAB #21 ;#10 ;Stamina 

PRINT " " 

HVTAB #21 ;#10 ;Stamina 

REP %001 10000:1 8-bit mode 

LDX #0 

LDA #0 

STZ STAMCNT 

STZ STAMCNT2 

CLC 

LDA STAMCNT2 

ADC #10 

STA STAMCNT2 

LDX STAMCNT 

INX 

STX STAMCNT 

CPX #999 

BEQ ]QUITA 

LDA STAMCNT2 

CMP AA+2 

BEQ JQUITA 

BRA ]LUPA 

LDA STAMCNT 

CLC 

PRDEC16 ;PRINT STAMINA 

SEP %0011 0000 ;8-bit mode 

HVTAB #21 ;#11 ;Mana 
PRINT " " 

HVTAB #21 ;#11 ;Mana 
LDX AA+4 
LDA AA+5 

PRDEC ;Print Decimal of two byte 

location 

HVTAB#21;#13 :Str 
PRINT " " 
HVTAB#21;#13 ;Str 
LDX AA+6 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 



;Dex 



:JMPA 

JMPB 

JMPC 

JMPD 

JMPE 

JMPF 

JMPG 

:JMPH 

:JMPI 

:JMPJ 

:JMPK 

:JMPL 

JMPM 

JMPN 

:JMPO 

:JMPESC 



GETKEY 
CMP rA' 
BEQ :JMPA 
CMP #"B" 
BEQ :JMPB 
CMP #"C" 
BEQ :JMPC 
CMP #"D" 
BEQ :JMPD 
CMP #"E" 
BEQ :JMPE 
CMP rF" 
BEQ :JMPF 
CMP #"G" 
BEQ :JMPG 
CMP #"H" 
BEQ :JMPH 
CMP #-|" 
BEQ :JMPI 
CMP #"J" 
BEQ :JMPJ 
CMP #"K" 
BEQ :JMPK 
CMP #"L" 
BEQ :JMPL 
CMP #"M" 
BEQ :JMPM . 
CMP #"N" 
BEQ :JMPN 
CMP #"0" 
BEQ :JMPO 
CMP #$9F&T ;ESC 
BEQ :JMPESC 
BRA ]LUP 

BRA HEALTH 

BRA STAMINA 

BRA MANA 

BRA STR 

BRL DEX 

BRL WIS 

BRL VIT 

BRL AMAGIC 

BRL AFIRE 

BRL FIGHTER 

BRL NINJA 

BRL PRIEST 

BRL WIZARD 

BRL SAVEIT 

BRL HELLO 

BRL QUIT 



;Get keypress 



;Entry to print 16-bit A 



%001 10000 

NH ;Entry to print 8-bit A,X 
NL 

#0 ;Left justify if CO 

:0V 

#"";Right justify if CS 
JUST 
#8 
NFL 
#"0"-1 

%001 00000 ;LongM 
NL :lndex length no matter 
;Needed 1st time 

NL 

:NUMTBL,X 
:DIV 
%001 10000 



:DIG 

#"0" 

:MODE 

NFL 

NFL 

:DIG 

JUST 

:NX 

COUT 

:LOAD0 



DEC16 TAX 
XBA 

DEC PHY 
PHP 
SEP 
STA 
STX 
LDA 
BCC 
LDA 

:0V STA 
LDX 
STX 

:LOAD0 LDY 
REP 
LDA 
SEC 

:DIV INY 

STA 
SBC 
BCS 
SEP 
TYA 
DEX 
BMI 
CMP 
BEQ 
STA 

:MODE BIT 
BMI 
LDA 
BPL 

:DIG JSR 

:NX DEX 

BPL 
PLP 
PLY 
RTS 



:NUMTBL DA 1,10,100,1000,10000 



•The GET KEY 

KEY REP $30 

LDALKYBD 
BPL KEY 
STAL STROBE 
SEP $30 
RTS 

* Routine used for changing men & Level 

CMP2 CMP#$9F&"U" ;RIGHT ARROW 
BEQ :ADD 

CMP#$9F&"K" :UP ARROW 
BEQ :ADD 

CMP#$9F&"H" ;LEFT ARROW 
BEQ :MINUS 

CMP #$9F8."J" :DOWN ARROW 
BEQ :MINUS 

CMP #$9F&"M" ;RETURN 
BEQ :CONT 
CMP #$9F&"[" ;ESC 
BEQ :QUIT 

LDA #0 ;RESULT = : WRONG KEY 

RTS 

:ADD LDA #1 ;RESULT = 1 : CORRECT 

STA STATUS 
CLC 
RTS 

* 

:MINUS LDA #1 iRESULT = 1 : CORRECT 

STA STATUS 
SEC 
RTS 



:CONT LDA #2 



;RESULT = 2 : GOTO 
EDITOR 



NL 
NH 
NFL 
JUST 



DFB 
DFB 
DFB 
DFB 



' The SENDMSG Macro 



SENDMSG PHP 



]LUP 



;Dex 



HVTAB#2l3»14 
PRINT " " 
HVTAB#21;#14 
LDX AA-hS 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 

HVTAB#21;#15 ;Wis 
PRINT • " 
HVTAB #21 #15 ;Wis 
LDX AA-flO 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 

HVTAB#21;#16 ;Vit 
PRINT " " 
HVTAB#21;#16 ;Vit 
LDX AA■^12 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 

HVTAB#21;#17 ;Anti-magic 
PRINT " " 

HVTAB#21;#17 ;Anti-magic 
LDX AA+1 4 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 

HVTAB#21;#18 :Anti-fire 
PRINT " " 

HVTAB#21;#18 ;Anti-lire 
LDX AA+1 6 
LDA #$0 

PRDEC ;Print Decimal of one byte 

location 

HVTAB #45;#9 ;Fighter 

PRINT ■ 

HVTAB #45 ;#9 ;Fighter 

LDY #0 

JSR PRINTCL iCheck for level 

HVTAB #45 :#10 ;Ninja 

PRINT " 

HVTAB #45;#10 ;Ninja 

LDY #4 

JSR PRINTCL ;Check for level 



Changing information 

HEALTH JSR CHANGE 
PRINT "Health:" 
LDY #0 
BRL CH2B 

STAMINA JSR CHANGE 

PRINT "Stamina:" 
LDY #2 
, BRL CHSP 

MANA JSR CHANGE 
PRINT "Mana:" 
LDY #4 
BRL CH2B 

* 

STR JSR CHANGE 

PRINT "Strength:" 
LDY #6 
BRL CH1B 

DEX JSR CHANGE 

PRINT "Dexterity:" 
LDY #8 
BRL CH1B 

WIS JSR CHANGE 

PRINT "Wisdom:" 
LDY #10 
BRL CH1B 

VIT JSR CHANGE 

PRINT "Vitality:" 
LDY #12 
BRL CH1B 

AMAGIC JSR CHANGE 

PRINT "Anti-magic:" 
LDY #14 
BRL CH1B 

AFIRE JSR CHANGE 

PRINT "Anti-fire:" 
LDY #18 
BRL CH1B 

FIGHTER JSR CHANGE 
PRINT "Rghter:" 

LDY #0 ;We are doing Fighter 

BRL CHCL 

NINJA JSR CHANGE 
PRINT "Ninja:" 

LDY #4 ;We are doing Ninja 
BRL CHCL 

PRIEST JSR CHANGE 
PRINT "Priest:" 

LDY #8 ;We are doing Priest 

BRL CHCL 



REP %001 00001 

LDA 2,S ;Get return address 

INC 

STA 2,S ;Point to next byte 

SEP %001 10000 

LDY #0 

LDA (2,S),Y ;Get next byte 

BEQ :BACK ;Exitif0 

JSR COUT iProcess it (OUTPUT) 

BRA ]LUP ;Loop always 



:BACK 



PLP 
RTS 



:Return to caller 



* The COUT routine 



COUT PHA 
PHY 
PHX 
PHP 

REP %00110000 
PHA 
WriteChr 
PLP 
PLX 
PLY 
PLA 
RTS 

* The Printy compare subroutine 

PRINTCMPSEP %00110000;8-bitmode 



ISKP2 



CMP #$2C 
BEQ ]SKP2 
CMP #$2E 
BEQ 1SKP2 
CMP #$3A 
BEQ ]SKP2 
CMP #$3B 
BEQ ]SKP2 
CMP #$20 
BEQ ]SKP2 
CLC 
RTS 
SEC 
RTS 



;Branch if match 

;Branch if match 

;Branch if match 

;Branch if match 

iBranch if match 
iCIear Carry to continue 
; with the rest of the checks 
;Sel carry to goto print 
; routine 



' The Printy1-3 subroutines for Printy Macro 



PRINTY1 



STZ YYY 

STZ XXX 

STZ XXX+1 

REP %001 1 0000 ;1 6-bit mode 

CLC 

LDA FOUND 



DEC 
TAX 
STX XXX 



:Subtract 1 

[Transfer Accum to X 
:Put back in XXX ; 



SEP %00110000;8-bitmode, 

; Discard Hi-byte 
RTS 

PRINTY2 JSR PRINTCMP;Carryissetiftherevras 
; any special characters 



STA STATUS 

CLC 

RTS 

:QUIT LDA #3 ;RESULT = 3 : GOTOQUIT 

STA STATUS 
CLC 
RTS 

* The routine that changes class 

ADJCL CLC 

ADJUST ;Adjust counter 

BCS SUBCL :Subtractone 

CLC 

LDA STATUS 

CMP #2 ' 

BEQ JRETCL ;Keep score/continue 

CMP #3 

BEQ JRETCL ;Exit completely 
DONECL LDX LEVNUM 

CPX #45 

BEQ jCLSKIP 

INX 

INX 

INX 

STX LEVNUM 

jCLSKIP LDY YYY 

LDX LEVNUM 

LDA NE02,X 
STA BB,Y 

LDA NE02+1,X 
STA BB+1,Y 

LDA NE02+2,X 
STA BB+2,Y 

IRETCL RTS ;Go back for mor adjustment 

SUBCL CLC ;aear carry 

LDA LEVNUM ;Getbyte 

CMP #0 ;0n the safe side.... 

BEQ ]SUBCL2 ; if then skip 

LDA LEVNUM 

DEC 

DEC 

DEC 

STA LEVNUM 
JSUBCL2 BRA JCLSKIP 

* The routine that changes Stamina 

t 

ADJSP ADJUST lAdjust counter 

BCS SUBSP iSubtractone 

CLC 

LDA STATUS 

CMP #2 

BEQ JRETSP ;Keep score/continue 

CMP #3 

BEQ JRETSP ;Exit completely 

REP %0011 0000 ;1 6-bit mode 

CLC 

LDA STAMCNT ;Adjust Stamina counter 

ADC #10 

CMP #999 

BCC ISKSP3 ;lf less than.... 

LDA #999 
JSKSP3 STA STAMCNT 

CLC 

LDY YYY 

LDA AA,Y ;Getbyte 

ADC #100 ;lhcrease 

CMP #9990 ; 

BCC JDONESP ;IFLESS 

LDA #9990 ; 
JDONESP STA AA,Y ; 

SEP %001 1 0000 ;8-bit mode 
JRETSP RTS ;Go back for more adjustment 

SUBSP REP %001 10000:1 6-bit mode 
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SEC 

LDA STAMCNT 

SBC #10 

CLC 

CMP #30 

BCS 1SUBSP2 ;lf greater than.. 

LDA #30 
]SUBSP2 STA STAMCNT 

SEC 

LDY YYY 

LDA AA,Y ;Gett)yt8 

SBC #100 

CMP #300 

BCS ISUBSP 

LDA #300 
]SUBSP BRA JDONESP 

SEP %001 10000 ;8-bit mode 
' The routine that changes 1-byte location 



ADJ1B 


CLC 




ADJUST ;Adjust counter 




BCS SUB1B iSubtractone 




CLC 




LDA STATUS 




CMP #2 




BEQ JRET1B ;Keep score/continue 




CMP #3 




BEQ ]RET1B ;Exit completely 




CLC 




LDY YYY 




LDA AA,Y iGetbyte 




ADC #5 increase by 5 




CMP #150 ;150 




BEQ ]D0NE1B ;IF = 




BCC jDONEIB jFLESS 




LDA #150 


]D0NE1B 


LDY YYY 




STA AA,Y 




STA AA+1,Y ;Echo the byte so that things 




; will work when in 16-bit 




mode. 


]RET1B 

* 


RTS ;Go back former adjustment 


SUB1B 


CLC iQear carry 




LDY YYY 




LDA AA,Y iGetbyte 




CMP #6 




BCC ]SUB1 B1 iBranch if less than 




SEC 




SBC #5 ;decreasebyfive 




CMP #5 




BCS JSUBIB 


1SUB1B1 


LDA #5 


]SUB1B 


CLC 


* 


BRA ]D0I^1B 


* The routine that changes 2-byte location 


ADJ2B 


ADJUST lAdjust counter 




BCS SUB2B ;Subtractone 




CLC 




LDA STATUS 




CMP #2 




BEQ ]RET2B ;Keep score/continue 




CMP #3 




BEQ ]RET2B ;Exit completely 




REP %001 10000:1 6-bit mode 




CLC 


.) 


LDY YYY 




LDA AA,Y iGetbyte 




ADC #10 ; Add 10 




CMP #999 




BEQ ]D0NE2B ;IF = 




BCC 1D0NE2B ;IFLESS 




LDA #999 


]D0NE2B 


LDY YYY 




STA AA,Y 




SEP %00110000;8-bitmode 


1RET2B 


RTS ;Go back for more adjustment 


SUB2B 


CLC ;Clearcany 




REP %00110000;16-bitmode 




LDY YYY 




LDA AA,Y ;Getbyte 




CMP #10 




BCC JSUB2B2 




SEC 




SBC #10 ; Subtract 10 




CMP #10 




BCS ]SUB2B 


]SUB2B2 


LDA #10 


1SUB2B 


CLC 




BRA ]D0NE2B 



LDY #8 
LDX #$4C 
LDA #$2 
JSR LOAD 

LDY #10 

LDX #$4F 

LDA #$2 

JSR LOAD 

LDY #12 
LDX #$52 
LDA #$2 
JSR LOAD 

LDY #14 
LDX #$55 
LDA #$2 
JSR LOAD 

LDY #16 
LDX #$58 
LDA #$2 
JSR LOAD 

LDY #18 
LDX #$5D 
LDA #$4 
JSR LOAD 

LDY #22 
LDX #$63 
LDA #$4 
JSR LOAD 

LDY #26 

LDX #$69 

LDA #$4 

JSR LOAD 



LDY 
LDX 
LDA 
JSR LOAD 



#30 
#$6F 



]LUP 



ICON 



LDX #6 
LDA AA,X 
STA AA+1,X 
INX 
INX 

CPX #18 
BEQ ICON 
BRA ]LUP 

RTS 



location to store value 
;Dexterity-e 

;Get bytes & store bytes 

location to store value 
;Wisdom-f 

;Get bytes & store bytes 

jLocation to store value 
;Vitality-g 

;Get bytes & store bytes 

location to store value 
;Anti-magic-h 

;Get bytes & store bytes 

location to store value 
;Anti-fire-i 

;Get bytes & store bytes 

location to store value 
;Fighter-j 

;Get bytes & store bytes 

location to store value 
;Ninja-k 

;Get bytes & store bytes 

jLocation to store value 
;Priest-l 

;Get bytes & store bytes 

;Location to store value 
;Wizard-m 

;Get bytes & store bytes 

;Start at position 6 
;Load pennanent score 
;Stay at adjustment score 
;Push pointer ahead by 2 

:Are we done yet? 

iBranch if equal 

;Do the next set of bytes 



* The byte transfer routine.... 

* A=# of bytes,X=get location,Y=Destination location 

* 

LOAD 



]BD 



]B4D 



JSR 


PREP 


LDA 


CHAR 


CMP #"1- 


BEQ 


jBA 


CMPrr 


BEQ 


IBB 


CMP #-r 


BEQ jBC 


LDA 


AAA 


CMP #2 


BEQ 


]B2D 



]B2D 



SEP %001 1 0000 :8-bit mode 
* Prep for Load S Transfer Routines 



IBC 
JBA 

]B4A 



PREP STA AAA ;SaveAccum. 
REP %001 10000:1 6-bit mode 
STZ XXX :ZeroXXX 
STX XXX ;Save XXX temporary 
CLC 

LDA FOUND ;Found + xxx = location 
ADC XXX 

STA XXX :Ilpdate xxx with correct loc. 
SEP %0011 0000 :8-bit mode 
RTS 

* 


* Copy game bytes to play 


area 


COPYGP LDX #$36 
LDY #0 
LDA #$2 
JSR LOAD 

* 


:Health-a 

iLocation to store value 

;Get bytes & store bytes 


LDX #$3A 
LDY #2 
LDA #$2 
JSR LOAD 

* 


:Stamina-b 

:L.ocation to store value 

:Get bytes & store bytes 


LDX #$3E 
LDY #4 
LDA #$2 
JSR LOAD 


:Mana-c 

;Location to store value 

:Get bytes & store bytes 


LDY #6 
LDX #$49 
LDA #$2 
JSR LOAD 


iLocation to store value 
:Strength-d • 

:Get bytes & store bytes 



]B2A 



:Restore Accum. and check for 
:how many bytes to transfer 



REP %001 10000:1 6-bit mode 
LDX XXX 

LDALNAMED,X :Get2-Bytes 
STA AA.Y ;Sta2-bytes 
LDAL NAMED+2,X :Get 3rd byte 
STA AA+2.Y :Stay 3rd byte 
SEP %001 1 0000 :8-bit mode 
RTS 

REP %001 10000:1 6-bit mode 

LDX XXX 

LDALNAMED,X :Get Accum.X...2-Bytes 

STA AA,Y :StaAccum,Y...2-bytes 

SEP %001 1 0000 :8-bit mode 

RTS :Retum 

BRA ]BCC 

LDA AAA :Restore Accum. and check for 
CMP #2 :how many bytes to transfer 
BEQ ]B2A 

REP %001 10000:1 6-bit mode 
LDX XXX 

LDALNAMEA,X :Get2-Bytes 
STA AA,Y :Sta2-bytes 
LDAL NAMEA+2,X :Get 3rd byte 
STA AA+2,Y :Stay 3rd byte 
SEP %001 1 0000 :8-bit mode 
RTS 



REP %001 1 0000 ;1 6-bit mode 
LDX XXX 

LDALNAMEA,X :Get Accum.X...2 
STA AA,Y :StaAccum,Y...2-bytes 
SEP %0011 0000 :8-bit mode 
RTS :Retum 



]BCC 

ft 

]B4C 



LDA AAA 
CMP #2 
BEQ ]B2C 



:Re5tore Accum. and check for 
:how many bytes lo transfer 



JB2C 



REP %00110000:16-bitmode 
LDX XXX 

LDALNAMEC,X :Get2-Bytes 
STA AA,Y :Sta2-bytes 
LDALNAMEC+2,X :Get 3rd byte 
STA AA+2,Y :Stay 3rd byte 
SEP %0011 0000 ;8-bit mode 
RTS 

REP %001 10000:1 6-bit mode 

LDX XXX 

LDALNAMECX ;Get Accum.X...2-Bytes 

STA AA,Y :Sta Accum, Y...2-bytes 

SEP %0011 0000 :8-bit mode 

RTS :Retum 



]S4A 



' Copy play area back to game 



LDA AAA 
CMP #2 
BEQ ]B2B 



:Restore Accum. and check for 
:how many bytes to transfer 



COPYPG LDX #$34 
LDY #0 
LDA #3 
JSR SAVE 


:Health-a 

:Location to store value 

:Get bytes & store bytes 


LDX #$38 
LDY #2 
LDA #3 
JSR SAVE 


;Stamina-b 

:Location to store value 

:Get bytes & store bytes 


LDX #$3C 
LDY #4 
LDA #3 
JSR SAVE 


:Mana-c 

:Location to store value 

:Get bytes S store bytes 


LDX #$49 
LDY #6 
LDA #2 
JSR SAVE 

* 


:Strength-d 
:Location to store value 

:Get bytes & store bytes 


LDX #$4C 
LDY #8 
LDA #2 
JSR SAVE 

* 


:Dexterity-e 
:Location to store value 

;Get bytes & store bytes 


LDX #$4F 
LDY #10 
LDA #2 
JSR SAVE 

• 


:Wisdom-f 

:Locatlon to store value 

:Get bytes & store bytes 


LDX #$52 
LDY #12 
LDA #2 
JSR SAVE 

* 


:Vitality-g 

:Location to store value 

:Get bytes & store bytes 


LDX #$55 
LDY #14 
LDA #2 
JSR SAVE 


:Anti-magk;-h 
:Location to store value 

:Get bytes & store bytes 


LDX #$58 
LDY #16 
LDA #2 
JSR SAVE 

• 


:Anti-fire-i 

:Location to store value 

:Get bytes & store bytes 


LDX #$5D 
LDY #18 
LDA #4 
JSR SAVE 


:Rghter-j 

:Location to store value 

:Get bytes & store bytes 


LDX #$63 
LDY #22 
LDA #4 
JSR SAVE 

* 


:l^nja-k 

:Location to store value 

;Get bytes & store bytes 


LDX #$69 
LDY #26 
LDA #4 
JSR SAVE 


:PriesH 

:Location to store value 

;Get bytes & store bytes ' 


LDX #$6F 
LDY #30 
LDA #4 
JSR SAVE 

* 


:Wizard-m 

:Location to store value 

:Get bytes & store bytes 


RTS 

* 


lAHbRSDAYSOF 

SEARCHING, 

:l FINALLY FOUND MY SAVE/ 

QUITBUGIII 

:l WAS NOT RETURNING TO 

THE CALLER.... 


'The save routine.... 

* A=# of bytes,X=get location,Y=Destination location 


SAVE JSR PREP 
LDA CHAR 
CMP #"1" 
BEQ ]SA 
CMP #"2" 
BEQ ]SB 
CMPrS" 
BEQ ]SC 

* 




]SD LDA AAA 
CMP #2 
BEG 1S2D 
CMP #3 
BEG IS3D 


:Restore Accum. and check for 
: how many bytes to transfer 



jSC 
]S3A 



]S2A 



]SB1 



]S4B 



]S3B 



]S2B 



]XC 



]S4C 



]S3C 



LDA AA,Y ;GetAccum,Y...2-bytes 
STAL NAMED,X :Slay Accum,X...2-Bytes 
SEP %001 1 0000 :8-bit mode 
RTS :Retum 



]SB 


BRA ]SB1 




ISA 


LDA AAA 
CMP #2 
BEQ ]S2A 
CMP #3 
BEQ ]S3A 


:Restore Accum. and check for 
;how many bytes to transfer 



REP %001 10000:1 6-bit mode 
LDX XXX 

LDA AA,Y ;Get2-bytes 
STALNAMEA,X :Stay2-Bytes 
LDA AA+2,Y ;Get 3rd byte 
STAL NAMEA+2,X :Stay 3rd byte 
SEP %0011 0000 :8-bit mode 
RTS 

BRA ]SCC 

REP %001 10000:1 6-bit mode 

LDX XXX 

LDA AA,Y :GetAccum,Y...2-bytes 

STALNAMEA,X :Stay Accum,X...2-Bytes 

STAL NAMEA+2,X :Stay Accum,X...2- 

Bytes 
SEP %001 1 0000 :8-bit mode 
RTS :Return 

REP %0011 0000:1 6-bit mode 

LDX XXX 

LDA AA,Y :GetAccum,Y...2-bytes 

STALNAMEA,X :Stay Accum,X...2-Bytes 

SEP %00110000:8-bitmode 

RTS :Retum 



LDA AAA 
CMP #2 
BEQ ]S2B 
CMP #3 
BEQ ]S3B 



:Restore Accum. and check for 
:how many bytes to transfer 



REP %0011 0000:1 6-bit mode 
LDX XXX 

LDA AA,Y :Get2-bytes 
STALNAMEB,X :Stay2-Bytes 
LDA AA+2,Y :Get 3rd byte 
STAL NAMEB+2,X :Stay 3rd byte 
SEP %001 1 0000 :8-bit mode 
RTS 

REP %001 10000:1 6-bit mode 

LDX XXX 

LDA AA,Y :GetAccum,Y...2-bytes 

STALNAMEB,X :Stay Accum,X..2-Bytes 

STALNAMEB+2,X :Stay Aceum,X...2- 



SEP %0011 0000 :8-bit mode 
RTS :Retum 

REP %001 10000:1 6-bit mode - 

LDX XXX 

LDA AA,Y :GetAcCum,Y...2-bytes 

STAL NAMEB.X :Stay Accum,X...2-Bytes 

SEP %0011 0000 :8-bit mode 

RTS :Retum 



LDA AAA 
CMP #2 
BEQ ]S2C 
CMP #3 
BEQ 1S3C 



:Restore Accum. and check for 
;how many bytes to transfer 



REP %001 1 0000 ;1 6-bit mode 
LDX XXX 

LDA AA,Y :Get2-bytes 
STALNAMECX ;Stay2-Bytes 
LDA AA+2,Y :Get 3rd byte 
STAL NAMEC+2,X :Stay 3rd byte 
SEP %001 1 0000 :8-bit mode 
RTS 

REP %001 1 0000 ;1 6-bit mode 

LDX XXX 

LDA AA,Y ;Gel Accum, Y...2-bytes 

STALNAMECX :Stay Accum,X..2-Bytes 

STALNAMEC+2,X :Stay Accum.X...2- 

Bytes 
SEP %001 10000 :8-bit mode 
RTS :Retum 



]B2B 



REP %001 10000:1 6-bit mode 
LDX XXX 

LDALNAMEB,X :Get2-Bytes 
STA AA,Y :Sta2-bytes 
LDALNAMED+2,X :Get 3rd byte 
STA AA+2,Y ;Stay 3rd byte 
SEP %0011 0000 :8-bit mode 
RTS 

REP %001 10000:1 6-bit mode 

LDX XXX 

LDALNAMEB.X :GetAccum,X...2-Bytes 

STA AA,Y :StaAccum,Y...2-bytes 

SEP %001 1 0000 :8-bit mode 

RTS :Retom 



]S4D REP %00110000:16-bitmode 

LDX XXX 

LDA AA,Y :Get2-bytes 
STALNAMED,X :Stay2-Bytes 
LDA AA+2,Y :Get2-bytes 
STAL NAMED+2,X :Stay 2-bytes 
SEP %001 1 0000 :8-bit mode 
RTS 

* 

]S3D REP %001 1 0000 :16-bit mode 

LDX XXX 

LDA AA,Y :GetAccum,Y...2-bytes 
STAL NAMED,X :Stay Accum,X...2-Byte 
STALNAMED+2,X 
SEP %001 10000 :8-bit mode 
RTS :Retum 

* 

]S2D REP %00110000:16-bitmode 

LDX XXX 



]S2C 


REP %001 10000:1 6-bit mode 




LDX XXX 




LDA AA.Y :GetAccum,Y...2-bytes 




STALNAMECX :Slay Aceum,X...2-Bytes 




SEP %0011 0000 :8-bit mode 




RTS :Retum 


' Change S Adjust bytes 

* 


CHANGE 


HVTAB#1:#21 




PRINT " 




HVTAB#5:#21 




PRINT "Use the arrow keys to raise or 




tower..." 




RTS 


CH1B 


STY YYY 


CH1B2 


JSR ]CH1B 




CLC 




LDA STATUS 




CMP #2 




BEQ jEDIB 




CMP #3 :ESC was pressed if hex 03 




found in Accum. 




BEG JQUITI B :Exlt completely if equals 


* 


BRA CH1B2 


1QUIT1B 


BRL QUIT 


jEDIB 


BRL EDIT0R2 



12 



Readers Data Exchange 



1CH1B HVTAB#52#21 
LDY YYY 

LDX AA,Y :Load Low byte into X 
LDA #$0 :Load Hi byte into Accum. 

COMPUTIST#75 



;Right justify 

;Print dedmaf to screen 



SEC 

PRDEC 

CLC 

BRL ADJ1B ;Go and adjust dedmai value 



CH2B STY YYY 
CH2B2 JSR ]CH2B 

CLC 

LDA STATUS 

CMP #2 

BEQ JED2B 

CMP #3 ;ESC was pressed if liex 03 
found in Accum. 

BEQ ]QUfT2B;Exit completely if equals 

BRA CH2B2 

* 

]QUIT2B BRL QUIT 
IED2B BRL EDIT0R2 

JCH2B HVTAB #52;#21 

REP %0011 0000 ;1 6-bit mode 

LDY YYY 

LDA AA,Y 

SEC ;right justify 

PRDEC1 6 ;Print dedmal to screen 

CLC 

SEP %0011 0000 ;8-bit mode 

BRL ADJ2B ;Go and adjust decimal value 



BEQ PSSNEO 

INC 

INC 

INC 

STA LEVNUM 

BRA jLESSNEO 

* 

jMCRENEOCLC 

LDX LEVNUM 
CPX #45 
BEQ jLESSNEO 
RTS 

* equal/greater than # = type 



NE02 
NEO 



CHCL 


STY YYY 


CHCL2 


JSR jCHCL 




CLC 




LDA STATUS 




CMP #2 




BEQ jEOa 




CMP #3 ;ESC was pressed if hex 03 




found in Accum. 




BEQ jQUrraiExit completely if equals 


* 


BRA CHCL2 


jQUITCL 


BRL QUIT 


jEDa 


BRL EDIT0R2 



TYPE 



adr #0 

adr #500 

adr #1000 

adr #2000 

adr #4000 

adr #8000 

adr #16000 

adr #32000 

adr #64000 

adr #128000 

adr #256000 

adr #512000 

adr #1024000 

adr #2048000 

adr #4096000 

adr #8192000 

adr #$FFFFF 

ASC " — 



;Neophyte 

;Novice 

;Apprentice 

;Journeyman 

;Craftsman 

;Artisan 



lExpert 
:Lo Master 
;Um Master 
:0n Master 
;EE Master 
;Pal Master 
:Mon Master 
;Arch Master 
:Maximum 

-"00 





3 

3 6 

6 9 

9 12 

12 15 

15 18 

18 21 

21 24 

24 27 

27 30 

30 33 

33 36 

36 39 

39 42 

42 45 



jCHCL HVTAB #54#21 
CLC 

JSR PRINTCL ;Print Level Type of class 
BRL ADJCL ;Go and adjust level of dass 



CHSP 


STY YYY 


CHSP2 


JSR jCHSP 




CLC 




LDA STATUS 




CMP #2 




BEQ jEDSP 




CMP #3 




BEQ jSKSP 




BRA CHSP2 


jSKSP 


BRL QUIT 


JEDSP 


BRL EDIT0R2 


jCHSP 


HVTAB #52;#21 




REP %00110000;16-bitmode 




LDA STAMCNT 




SEC . , 




PRDEC16 ;PRINT STAMINA 




SEP %001 10000 :8-bit mode 


• 


BRL ADJSP 


* Prints out the level of class, Y*4 = Qass 

t 


PRINTCL 


LDX #0 




STX LEVNUM 




STY YYY 


jLUP 


JSR CK1NEQ 




CPX #45 




BEQ jFINISH 




INX 




INX 




INX 




STX LEVNUM 




BRA jLUP 


jFINISH 

* 


RTS 


CK1NE0 


CLC 




LDY YYY 




LDX LEVNUM 




LDA BB+2,Y 




CMP NE0+2.X 




see jLESSNEO ;Less than.... 




BEQ JCK2NE0 ;Equal to.... 


* 


BCS ]MORE^EO:Greaterthan.... 


P<2NE0 


CLC 




LDA BB+1.Y 




CMP NE0+1,X 




BCC LESSNEO 




BEQ JCK3NE0 


. 


BCS MORENEO 


1CK3NE0 


CLC 




LDA BB,Y 




CMP NEO.X 




BCC JLESSNEO 




BEQ jEQUAL 


* 


BCS jMORENEO 


jLESSNEO CLC 




LDY #0 




LDA LEVNUM 




ASL ;Multiplyt>y2 




ASL iMultiply by 2 




TAX Jransfer Accum to X 


jLUP 


LDA TYPE,X ;Get byte of name 




CMP#0 




BEQ lDONENEO;lfOthen.... 




JSR COUT ;Printbyte 




INX ;lncrfiase X 




INY 




CPY #12 




BEQ jDONENEO 


. 


BRA jLUP ;Branch if less than.... 


jDONENEOLDY YYY 




LDX #45 


* 


RTS 


jEQUAL 


CLC 




LDA LEVNUM ;To be on the safe side 




CMP #45 



AAA 
XXX 
YYY 



ASC "Neophyte "00 

ASC "Novice "00 

ASC "Apprentice "00 

ASC "Journeyman "00 

ASC "Craftsman "00 

ASC "Artisan "00 

ASC "Adept "00 

ASC "Expert XO 

ASC "LO Master "00 

AX "UM Master tX) 

AX "ON Master "00 

AX "EE Master "00 

AX "PAL Master "00 

AX "MON Master "00 

AX "ARCH MasteTOO 

DA 
DA 
DA 



LEVNUM 

RAM 

CHAR 

FOUND 

STATUS 

STAMCNT DA 

STAMCNT2 DA 



DA 
DA 
DA 
DA 
DA 



* The Storage area to edit the character stats 
AA 



BB 



DA 
DA 
DA 
DA 
DA 
DA 
DA 
DA 
DA 
DS 
DS 
DS 
DS 



;Health 

;Stamina 

:Mana 

Str 

;Dex 

;Wis 

Vit 

Anti-magic 

Anti-fire 

Fighter 

Ninja 

Priest 

;Wizard 





2 

4 

6 

8 

10 

12 

14 

16 



4 

8 

12 



DGM.MACRO.S 



Macros used by DM4 

* 




•The GET KEY MACRO 




GETKEY MAC 

JSR KEY 




<« 




ADJUST MAC 
JLUP GETKEY 

JSR CMP2 
BEQ ILUP 

<« 

* 


;IF RESULT = 0,BRAI 


•The Draw LINE Macro 




LINE MAC 

LDY #80 
jLUP LDA r " 

JSR COUT 

DEY 

BNE jLUP 

<« 


;Routine used to print 
; a straight line across 
: the screen. 


•TheHVlab 




HVTAB MAC 

SEP %00110000;8-bitmode 

LDA #]2 ;Vertical 

STALCV 

LDA rJ"8$9F;Unefeed 

JSR COUT 

LDA #]1 ;Horizontal 

STALCH 


<« 




•The PRINT Macro 




PRINT MAC 

JSR SENDMX 
ASC j1 
BRK 


<« 

* 




PRINTY MAC 

JSR PRINTY1 




3 
6 
9 
12 
15 



45 



12 

24 

36 

48 

60 

72 18 

84 21 

96 24 
108 27 
120 30 
132 33 
144 36 
156 39 
168 42 
180 45 



jLUP REP %00110000;16-bitmode 

INC XXX ;lncreaseXXXLoc. 

LDX XXX 

LDALjLX ;Load Location - 1 



SEP %0011 0000 ;8-Bit mode 
BEQ jDONE ;Branchifzero(0) 
JSR PRINTY2 ;Go and print it 
INC YYY 
LDY YYY 
CPY #$7 



jDONE 



BX jLUP 
«< 



;Allow only 7 letters in the 

name 

jBranch if less than 



•The COUT Macro 

Tool MAC 

LDX #]1 
JSL $E10000 



WriteChr 



MAC 

Tool $180C 

<« 



* The Print Dedmal Macros 

PRDEC16 MAC 

JSR DEC16 
«< 



PRDEC 



MAC 

JSR DEC 
«< 



Robin Lockslev 



MO 



Softkey for... 

Dungeon Master 

FTL 

Requirements: 
Apple IIGS 
Copy n Plus V. 9.0 

My thanks to Jim Ross. I love DungeonMastor 
but have been frustrated by the complex and 
novel arrangement of codes. I would like to add 
to what he has provided by supplying some 
additional information. 

First I have discovered two versions of Dun- 
geon Master. They are 2.0 and 2.1. 1 also found 
that the byte locations jwovided by Jim were not 
the same for my disk even though I believe that 
he was working with v 2.0. 

This is the sector edit that I have found for 
version 2.0. 

Blk Bvte From To 

104 110 18 38 

104 114 38 18 

This is the Sector edit for version 2.1 



Blk 


Byte 


From 


To 


0E6 


110 


18 


38 


0E6 


114 


38 


18 



If you are interested in loading Dungeon 
Master onto the Copy II Plus parameter file 
follow these directions. 

Load Copy II Plus (I use 9.0) 

Select COPY (return) 

Select BIT COPY 3.5 (return) 

Arrowdown to CREATE hfEWPARAMETERS 

(retum) 

When the new screen appears type in die 
following: 

Name : Dungeon Master V 2 . 
By: FTL 



SECTOR COPY 

TO 

SECTOR EDIT, BLOCK 104, 110:38, 

114:18 

Do the same thing for the second version. 

Name: Dungeon Master V 2.1 
By: FTL 



SECTC» COPY 

TO 

SECTOR EDIT, BLOCK 0E6, 110:38, 

114:18 

If you don't find the proper codes on blocks 
104 or 0E6 try scanning for 18 AB 2B 6B 38. If 
you find these you should beabletofiUintherest. 



PA 



Joseph P. Karwoski 

Softkey for... 

Victory Road 
. Heavy Barrel 
Data East 

These games are only barely interesting. I 
was not impressed with them at all, they are no 
"Wings of Fury". 

1. Boot your DOS 3.3 system disk. 

2. Tell DOS to ignore checksum and epilog errors 
and use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

3. Search the disk for 4C 00 G6 and replace them 
with EA E A E A. (I found this on track 0, sector 
OE, byte 4A.) 

4. You are done, and can "enjoy" the games. 

For those of you interested, I will take you 
through the process that I used to find this edit - 
even though it is very simple. 

When I first got the games, I tried to CATA- 
LOG the disk using Copy M+. All I got was a lot 
of problems, and then an error message (on 
Victory Road, for Heavy Banel I got a catalog). 
This told me that they had changed the disk 
format. My next step was to tell DOS to ignore 



the checksum and epilogues (I did this with the 
POKE47426,24). This wiUnof'hurt" even if the 
disk can be CATALOGed. Then I copied the 
disk. When it was done, I tried to boot the disk. 
What happened next gave me a clue as to what to 
look for. The disk keep rebooting - a clue! Know- 
ing the you can turn the disk on and reboot by 
typing C600G, meaning go to memory location 
C600 and execute. I decided to try looking for a 
JMP to diat memory location. I used the search 
command in Copy II-i-'s sector editor to search 
for 4C 00 C6, and was rewarded with success. I 
looked at the code and what I found suggested 
that the program continued as normal after that 
code. What was going on was that the program 
was checking for certain "items", and if it did not 
find what it was looking for it would go to this 
command. If it found what it wanted (an original) 
it would jump over this code. I decided to try the 
easy way out - THEY often don't make it this 
easy. I replaced the 4C 00 C6 with NOP's (EA 
EA EA), and then tried the games. They both 
worked without any problems. 

Answers to reader questions 

I saw a number of questions in issue #73 that 
I might be able to help with, so here goes. 

To Ron Stankiewicz: Copy of Alien Mind. 
In issue number 64 page 9, 1 gave a method to 
copy Alien Mind (bit copy using Copy II-I-). It 
takes a lot of time, and you may have to copy it 
a number of times, but it worked for me. 

To Ricky Lee Wallace: Reading the mouse 
from BASIC. If you are interested in using the 
mouse from withinaBASIC program, you should 
get the July 1990 issue of NIBBLE. On page 32 
you will find an excellent article (and program) 
on how to use the mouse. 

To Rob Fiduccia: Changing background, 
text, and border color on the Ilgs. You can use 
POKEs to change just about everything in the 
control panel . To change the screen, background, 
and text colors; memory location 49186 and 
49204 are the pokes you need. The easiest way to 
show you this is to give you a little Demo pro- 
gram. By-the-way, I had this printed in the Feb. 
1989 issue of NIBBLE. Before you start typing 
this, I must say : BE CAREFUL! ! These locations 
can also change other items in the control panel. 
Use the program the way I give it to you. Feel free 
to use this as you see fit. 

10 REM BG.BACKGROUND COLOR 

20 REM TE-TEXT COLOR 

30 REM BD=BORDER COLOR 

40 TEXT : HOME :A = PEEK (49186):B = PEEK 

(49204) 
50 VTAB (12): PRINT "WATCHOMEOCHANGE 

OMYOCOLORS" 
60 FOR BE = T0 15 
70FORTE = 0TO15 
80FORBD-0TO15 
90S = TE*16 + BG 
100 POKE 49186,S: REM SETS BACKGROUND 

COLOR AND TEXT COLOR 
1 10 K = PEEK (49204) 
120K = INT(K/16) 
130S = K*16 + BD 

140 POKE 49204,S: REM SET BORDER COLOR 
150 FOR I = 1 TO 1000: NEXT I: REM THIS IS A 

PAUSE 
160 NEXT BD 
170 NEXT TE 
180 NEXT BG 
190 POKE 49186,A: POKE 49204,B: REM THIS 

RESETS THE COLORS 
200 END 

Checksums 

10-$BADD 80-$FFDB 150-$0B46 

20-$9B13 90-$232B 160-$0192 

30-$4D3B 100-$08A4 170-$1DE7 

40-$F4l5 110-$B0CB 180-$8F37 

50-$8A15 120-$2C10 190-$0DB8 

60-$8CDD 130-$7411 200-$90FD 

70-$FBF8 140-$C020 

I hope this will give you the information that 
you wanted, good programming! 

Monitor Search command 

If you want to find the bytes 00 67 B 1 in the 
current bank, try . this command from Visit 
Monitor: \D0 67 BIVOOOO.FFFFP 

The search command is the P. By-the-way, to 
get Visit Monitor on the control panel, you must 
do the following. 

At the BASIC prompt: 
CALL -151 

Ctrl reset 

Now when you press Ctrl openapple esc, you 
will see "Visit Monitor" on the control panel. 



Softkey for.. 



Batman 



COMPUTIST#75 



Readers Data Excbaage 



Data East 

Requirements: 

Deprotected Heavy Barrel 

I thought Batman would be very easy. All 1 
had to do was the seime thing all over again. I was 
wrong. Everything went fine until I tried to 
search for 4C 00 C6. 1 could not find it on the 
disk! They must be trying something new on this 
one. By this time I was getting tired and I was in 
no mood to have a program give me a problem! 

. 13 



I looked through the disk, searching for some- 
thing that looked familiar. WhatI found was code 
that looked like a ProLok method of protection. 
See my article on deprotecting Where in North 
Dakota is Carmen S andiego by Broderbund (#73, 
pg7) for a more detailed explanation of this 
protection. I found this code on track 00, sector 
01, byte 76. 

Note: Using the sector editor, the BOMB is 
said to be 0E52, and if you get into the program 
it writes this address as D352. 

I thought that this would not be very hard, just 
refer to my notes on this and make the correct 
edits. I was wrong again. After I made the edits, 
the program still would not work - the screen got 
"funny" and the drive keep on running. OK, I 
missed something. Not too unexpected, I didn't 
look at the code that much - 1 was tired. As I was 
sitting at my computer thinking of the time it 
might take to trace all the "interesting" things that 
they might be doing, a thought came to me. 1 have 
a deprotected copy of Heavy Barrels, and Bat- 
man uses QuickDOS as does Heavy Barrels. 
What would happen if I were to copy Heavy 
B arrels, delete all the files, and then copy the files 
from Batman onto this disk. The answer I gave 
myself was "I don't know, but what do you have 
to lose". Then entire process took about 5 min. 
and when I was done, I have a deprotected copy 
of Batman. I know this was cheating, but that is 
why 1 call this a Semi-Softkey for Batman. 

1. Boot your DOS 3.3 system disk. 

2. Tell DOS to ignore checksum and epilog errors 
and use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

3. Take out a deprotected copy of Heavy Barrels 
and copy it onto a blank disk. I used Copy n+. 

4 . Delete all the files from the disk you just copied 
of Heavy Barrels. 

5. Copy all the files from your "non-bootable" 
copy of Batman to this new disk. 

Note: I just got the game Dark Castle by 
Three-Sixty and it does not appear to be pro- 
tected in any way. 

, I am very pleased that some companies are 
beginning to trust us, and I think they deserve a 
round of praise. I hope more companies get this 
idea. Also, I don't want anyone to think that I 
group Dark Castle in the same class as Heavy 
Barrel, etc. I don't, it is a much better game - the 
sound is excellent and the graphics are very good. 
It is a game that is worth the money. 



Zorro 



FL 



Soflkey for... 

Curse of the Azure Bonds 
Strategic Simulations, Inc. 

Requirements: 

Copy n Plus 

Eight (8) blank disk sides 

COMPUTIST #52 (optional) 

Curse of the Azure Bonds by Strategic Simu- 
lations Inc. is another in a series of computer 
adaptations to the Advanced Dungeons & Drag- 
ons saga. If you like the paper and pencil versions 
of AD & D, you'll enjoy this new computerized 
series even more, since the computer rolls the 
dice and keeps track of everything for you. 

Curse of the Azure Bonds (CAB) is the sequel 
to Pool of Radiance, and from what I've heard 
about the graphics in Pool of Radiance, you'll not 
have to endure a great lack of detail. Featuring 
nicely detailed landscapes and finely drawn, 
partially animated figures, CAB exceeds many 
other fantasy-role playing games such as Ultima 
V and Might & Magic both in detail and in sheer 
size. You begin the game as a group of six 
adventurers, either new or transferred from Pool 
of Radiance, who have awakened in a room at the 
inn of the town of Til verton after being ambushed 
awhile back by unknown assailants. The last 
thing you remember was agreeing to search for 
the lost princess Naccacia in southern Daleland 
(the mythical setting of this fantasy) back in Pool 
of Radiance. You discover that all your equip- 
menthas vanished, and that youhavebeen cursed 
by five azure tattoos, or bonds, impregnated 
within each party member's sword arm. These 
bonds, placed by a group of five conspirators, 
control your destiny, and when they glow, you 
are compelled to do their bidding. Obviously, 
your quest is to search Daleland for the people (or 
whatever) responsible for this curse. And with 
eight disk sides of Daleland, you'll be in for an 
extensive adventure. 

As to the protection, the disks are in normal 
format, and copy easily with any whole-disk 
copier. Obviously, if the disks are already 
copyable, why take the time to write a softkey? 
Well, if you examine the disks more closely (i.e. 
trying to CATALOG them, or load up files), 
you'll notice you can't do either, because CAB, 
like many other programs by SSI, is equipped 
with a customized version of DOS 3.3, called 
RDOS (for information on RDOS, see COM- 
PUTIST #52). But, more on eradicating RDOS 
later. Another reason to delve further into this 
program is the fact that before you are allowed to 
play the game, the program uses a code wheel as 
a secondary form of copy-protection. By asking 
you to match up two sets of runic symbols on a 
cardboard wheel, and typing in the first letter of 
14 



a word formed through the proper aligimient of 
the runes (which are chosen at random), CAB 
effectively ties you down with this cumbersome, 
needless necessity. And if you fail to align the 
runes despite the three chances given you, the 
program will hang and you'll have to reboot. 
Fortunately, though, after about half an hour's 
work one aftemoon, I discovered how to defeat 
this annoyance. 

First, I recorded exactly the letters of the 
message which prompted you to find the wheel 
and align the runes. I then booted Copy II Plus, 
and used the scan option within the sector editor 
to discover where on the boot disk the message 
resides. After several seconds, the search ended 
on track 303, sector SOE. If you're familiar with 
machine language, you know that often a text 
message is preceded by a jump to a subroutine 
that prints it on the screen. Then, following the 
message is a BRK, or SOO, which tells the print- 
ing subroutine that either the message has ended 
or that the line is full. Here is an example. 

03002000 60 JSR $6000 go to message printing 

subroutine 
0303:48 PHA message starts here; 

from here to 
0304:45 4C EOR $4C $0308, looks like 

gibberish, but 
0306:4C4F21 JMP $214F actually spells out 

'HELLO!' 
0309:00 BRK end of message 

To find out if this is the case with CAB , I first 
examined track S03, sector SOE for a string of 
fairly unique bytes. I chose 4C 10 6E, the JMP to 
the message printing subroutine, which precedes 
the message itself. Then, I booted the disk, and 
allowed the program to run until it asked for the 
proper letter, where I then pressed Control -Reset 
to enterBASIC (fortunately, CAB doesnotcause 
a reboot when you press Ctrl reset, as some other 
programs do). Right then and there, I entered the 
monitor and scaimed for the three bytes I chose 
earlier within memory, like this: 
CA LL-1 51 enter monitor 

4C106E<800.9000S scanfor4C106Ewithin$800- 

9000 

The search ended at $1750, and at that loca- 
tion was the command to JMP to $6E10. So now 
I knew where the message was, but I still was 
unsure about how to circumvent it. Begiiming 
with the nearest memory page, I listed memory 
on my printer from S1700-1800 to see if I could 
find an answer. 

1700:203918 JSR $1839 

1703:203118 JSR $1831 

1706:20 37 8A JSR $8A37 

1709:A902 LDA #$02 

170B:8D6A1A STA $1A6A 

170E:20 51 18 JSR $1851 

1711:F0 20 BEQ $1733 

1713:A9 5D LDA #$5D 

1715:A21A LDX #$1A 

1717:20 70 84 JSR $8470 

171A:CE6A1A DEC $1A6A 

171D:10EF BPL $170E 

171F:20 0A89 JSR $890A 

1 722:20 106F JSR $6F10 

1725:2042 89 JSR $8942 

1728:EE3768 INC $6837 

172B:A2 09 LDX #$09 

1720:20 3717 JSR $1737 

1730:403017 JMP $1730 

1733:204518 JSR $1845 

1736:60 RTS 

By now, I began to make some tests to see 
what was executed where. Just out of an arbitrary 
guess, I executed $1700 by typing 1700G from 
the monitor. Lo and behold, the message along 
with the runes appeared on hi-res page 1 ! Now 
that I knew the general chunk of code where the 
query functioned, I slowly and surely executed 
every JSR and JMP instruction one at a time 
(with hi-res page 1 displayed each time) to see 
what effect each operation would have on the 
display. JSR$1839? Nothing. JSR$1831?Noth- 
ing. JSR $8A37? Still nothing (nothing I could 
SEE, that is; routines such as these may not do 
anything to the hi-res display, but it could leave 
the right value in the right place). JSR $1851? 
YES ! ! If you execute this routine, you'll find that 
the runes and message are displayed on the screen, 
awaiting the proper keypress. 

Let's take a closer look at this particular 
section of code. We have the JSR to $1851, then 
a BEQ to S1733. Okay, at $1733, there is a JSR 
to S 1 845. So after the program receives akeypress 
from the JSR toS1851, if the zero flag is up(if the 
result from whatever operation was performed = 
0), then it branches to S1733 and subsequently 
JSR's to SI 845. Let's see what happens if the 
result is NOT zero. Alright, LDA #S5D, LDX 
#S1A...JSR S6F10 (I found that this clears the hi- 
res page of text - maybe preparing to print some- 
thing new?)...JSR SI 737, JSR $1730. 1 executed 
the JSR to S1737 in S172D, and it revealed the 
message you will see if you fail to align the runes: 
"STUDY YOUR EXDCUMENTATION AND 
REBOOT". Now I executedS1730, andl discov- 
ered that this little routine locks you out of the 
program; it just branches to itself endlessly, leav- 
ing the message on the screen and leaving you to 
the task of rebooting. 

Since the JSR S1851 is the heart of the code 
wheel protection, I decided to bypass the code in 
between by replacing the 20 51 18 (JSR $1851) 
with 4C 33 17 (JMP S1733) so that instead of 
asking for the letters and waiting for a correct 
response, it would simply branch to $1845 as if 
the result of the JSR to $1851 was zero. So I 



edited the appropriate bytes on track $03, sector 
$0E, and when I booted my copy, no more rune 
check. 

Up until this point, I had been playing CAB 
for several days, and just recently have I noticed 
a devious attempt at reinvoking the code wheel 
protection at other places within the game. For 
example, when I once wished to go from city A 
to city B, I had to cross a great chasm using a tiny 
footbridge. Guarding the bridge was an old man, 
who said I had to answer his questions before I 
could cross. Okay, this shouldn't be any prob- 
lem, right? First he asks me of my quest, so I say 
UNCURSE BONDS. He then asks what my 
favorite fruit is, so I say APPLE. Then he says 
WHAT DOES THIS MEAN, and right up on the 
screen once again appeared the old rune ques- 
tion. Apparently, the file containing the rune 
code is spread over more than just the boot side 
of CAB, so just as a precaution, I searched each 
disk side for 20 51 18 (JSR SI 851). Fortunately, 
this protection code exists only on the boot side 
and side 1 of DISK A, so I changed each accord- 
ingly to 4C 33 17 (JMP S 1 733). Finally, I was rid 
of the accursed runes, and I could now get on with 
getting rid of the accursed azure bonds! 

Step-by-step 

1. Using your favorite disk copier, copy all 8 
sides of the original CAB disks. 

2. Sector edit (using Copy II Plus, Inspector, 
etc.), the BOOT disk: 

Ills Ssl EyM From la 

$03 $0E $0E-10 20 5118 40 3317 

3. Sector edit side 1 of DISK A: 

TrK S£l Ei^la From Iq 

$02 $00 $0E-10 20 5118 40 3317 

Regain control of your destiny, and toss the 
code wheel. Maybe it's recyclable? 

Because CAB is such an extensive game, it 
would be nice to be able to put it on a hard disk 
or maybe a 3.5" microdisk. Since it uses the 
RDOS operating system, you can read M.M. 
McFadden' s article in COMPUTIST #52 on how 
to convert this DOS to normal ProDOS so you 
can move the program to abigger storage device. 
Unfortunately, however, the program called 
TRANSFER whichM.M. McFadden provided is 
flawed, and will not function! I must reiterate 
Thomas Rapheld's complaint in COMPUTIST 
#65, as he also has experienced this problem. 
Like he says, the program runs and prints 'IN- 
SERT RDOS DISK AND HIT RETURN', but 
immediately after you press return, the program 
goes through its operations and prints 'DONE', 
without transferring the program to normal Pro- 
DOS. I wishM.M. McFadden would look closely 
at this problem and find a solution. To help, I 
have what may be a lead to this case. Notice that 
to execute normally, CAB executes the JSR to 
$1845, which TURNS ON THE DISK DRIVE 
and executes the program normally. Well, when 
booting, this routine does just that, but occasion- 
ally when I broke into the program, and tried to 
execute JSR $1845, nothing happened, I was just 
returned to the monitor. I think somewhere the 
RWTS unhooked, and it may be that in TRANS- 
FER the proper RWTS hooks are not set, and the 
program ends without doing anything. Hope- 
fully, M.M. McFadden will solve this problem 
before my original disks go bad. 

To Ashish Morzaria: I read with interest 
your article in COMPUTIST #68 about defeating 
the code wheel in Pool of Radiance. To really get 
rid of the entire routine, I suggest using this 
method to eradicate the message and everything 
else. Just follow the general steps and you should 
be free of the runes forever. 

Softkey for... 

Omega 
Origin Systems, Inc. 

Requirements: 

Apple He, lie, Ilgs 

Super lOBv 1.5 

Two (2) blank, formatted, double-sided diskettes 

Some readers of COMPUTIST (including 
myself) have been clamoring for details about a 
program that is being softkeyed, mostly out of 
curiosity, but primarily to makeadecision whether 
or not to buy the program (after all, game players 
are the best playtesters). Well, the following will 
be a sort of softkey plus review, the softkey 
explained in depth for beginners and pros alike, 
and the review for anyone who's looking for a 
really excellent program, like Omega. 

As is common with many programs by soft- 
ware companies, including Origin, the player is 
transported to a completely unique realm (i.e. 
Britannia in the Ultima series, the futuristic post- 
nuclear world in Autoduel). Such is the case with 
one of their newest releases. Omega. As a cyber- 
netics engineer in the 24th century, you are 
provided employment by the Organization of 
Strategic Intelligence (OSI, also as in Origin 
Systems, Inc.), and are given the task of design- 
ing a number of self-contained, artificially intel- 
ligent robot cybertanks using the facilities at the 
OSI assembly plant. Much like Autoduel, an- 
other Origin product, you are given several op- 
tions concerning the assembly of your tank, which 
are limited by your current security clearance 
level, and consequently your bankroll; however, 
as you progress through all ten clearance levels 
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(by testing your tank versus ones manufactured 
by the bigwigs at OSI, including a tank called 
OGRE [hint,hint]), you eventually are allotted an 
unlimited budget, with which you can purchase 
the most powerful tank with all the trimmings 
(i.e. a Bentley class tank with ion drive, nuclear 
weapons, long-range scanners, defensive shields, 
etc.). 

Designing the most powerful tank you can 
with your 1000 credits at the lowest clearance 
level can indeed be a challenge, but don't assume 
that there are only one or two options for weap- 
onry and other items. There are perhaps hundreds 
of different combinations you can conjure up, 
dependent only upon your budget, and ample 
information on every option is given in the exten- 
sive 240 page manual that comes with the pack- 
age. There is, of course, one problem with similar 
simulation programs. As soon as you can get 
enough money to buy THE most powerful car, 
plane, spacecraft, or whatever, the game's pretty 
much over, since after that you can just blow all 
of your enemies sky-high. 

Ah, but the CYBERTANK has one special 
ability - it is artificially intelligent - and GUESS 
where it gets its smarts ! What sets this game apart 
from any I ' ve seen is the fact that you can actually 
PROGRAM your tanks with all the info you want 
to sufficiently pass clearance levels!!! Using 
commands like MOVE FORWARD 1, DO 
DESTROY, and many, many others, you can 
create your tank's intelligence, and teach it what 
to do in response to some sort of stimuli. When 
telling your tank what to do when it encounters an 
obstacle, for example, you can either say MOVE 
LEFT 1 to avoid the barrier, or HRE WEAPON 
AT OBSTRUCTION to blow it to smithereens! 
All of the tank's knowledge can either be pro- 
grammed manually or derived from what are 
called 'library capsules', which are like subrou- 
tines to a computer program, and then after the 
tank is programmed and the chassis is complete, 
you may submit your design for authorization by 
OSI, and then your tank's programming is auto- 
matically checked for bugs, as well! 

Obviously, it is difficult to summarize such 
an in-depth program in a paragraph or so, but the 
diversity in tank design combined with a variety 
of different programming options limited only 
by your imagination opens doors to an amazingly 
unique gaming experience. On a scale of 1 to 10, 
I give it a 10 for realism, lO-i- for variety, and 10 
for the superb documentation. 

On to the in-depth softkey 

To begin, I got out Disk Muncher 8.0 and 
attempted to make a working copy of each disk. 
All disks copied fine, with the exception of the 
boot side. I got read errors on all the odd tracks, 
which meant the format had been altered from 
normal DOS. Then, using the NIBBLE EDITOR 
option of Copy II Plus, I examined tracks $03 and 
$04 of the disk for any format changes. As I 
suspected, the address prologs for the odd tracks 
read D4 AA 96 rather than the normal D5 AA 96, 
and the address epilogs read AF Ax, where x is a 
randomized number from $0-F, which changes 
from sector to sector. Then, as I was deciding 
whether to go through the hassle of altering 
COPYA to ignore the first address prolog and the 
address epilogs, I remembered a softkey way 
back in COMPUTIST #57 by Aaron Schoeffler 
for Rings of Zilfin and Roadwar 2000 by SSI. 
Since the protection schemes on both Omega and 
Rings of Zilfin/Roadwar 2000 were nearly iden- 
tical, I decided to use his Super lOB controller to 
deprotect Omega. It worked nicely, and now all 
the disks are easily copyable. 

It pays to keep track of older softkeys. 
They save you from having to reinvent the 
wheel! EDEXed 

Step-by-step 

1 . Boot your disk with Super lOB on it and enter 
BASIC. 

2. Type in the controller. 

Controller 

1000 REM OMEGA 

1010 TK = 0:ST = 0:LT = 35:CD = WR 

1020 T1 = TK: GOSUB 490: POKE 47405,24: 

POKE 47406,96: POKE 47497,24: POKE 

47498,96 
1030 POKE 47445,213: IF TK / 2 <> INT (TK / 2) 

THEN POKE 47445,212 
1040 GOSUB 430: GOSUB 100:ST = ST + 1: IF ST 

< DOS THEN 1040 
1050 IF BF THEN 1080 

1060 ST = 0:TK = TK + 1:JK = 212: IF TK /2 = INT 

(TK/2)THENJK = 213 
1070 POKE 47445,JK: IF TK < LT THEN 1030 
1080 GOSUB 490:TK = T1:ST = 0: GOSUB 230 
1090 RESTORE 
1100 POKE 47405,208: POKE 47406,19: POKE 

47497,208: POKE 47498,1 83 
1110 GOSUB 430: GOSUB 1 00:ST = ST + 1 : IF ST 

< DOS THEN 1110 

1120ST = 0:TK = TK+1:IFBF = 0ANDTK<LT 

THEN 1110 
1130 IF TK<LT THEN 1020 
1 140 NORMAL : TEXT : HOME : PRINT "DONEO 

WITHOCOPY" : END 

Checksums 

1000-$356B 1050-$E19B 1100-$A4E3 
1010-$3266 1060-$B8A7 1110-$9AE2 
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1020-$2F76 1070-$6D24 1120-$4176 
1030-$659E 1080-$8BBC 1130-$6BB7 
1040-$7598 1090-$B829 1140-$20B5 

3. Execute CAPTURE from the COMPUTIST 
Starter Kit disk, and write the controller to disk 
with the name OMEGA. 

EXEC CAPTURE 
RUN 

4. Clear memory, load up Super lOB, and install 
the controller. 

NEW 

LOAD SUPER lOB 

EXEC CON.OMEGA 

5. RUN Super lOB, follow the prompts, and let 
the computer take over. 

That's it! 

Note on Am DOS 

In my article on how to put Autoduel on a 3.5" 
disk (#72, pg 15), I usedMicroSPARC's UniDOS 
3.5, which is a homolog of DOS 3.3 that can 
access 3.5" microdisks. Recently, though, I've 
found a cheaper alternative to shelling out S29.95 
for this program. While flipping through a cata- 
log I received from the Florida PC Library (a 
distributor of public domain and shareware pro- 
grams), I discovered a program nearly identicjil 
to UniDOS called AmDOS (Amateur DOS), 
which can format microdisks in the DOS 3.3 
format, andretain complete compatibility withit. 
For a mere S3 .00 plus shipping, the modification 
Ihavesubmittedcanbeperformedwithouthassles 
or worries. I've recently obtained access to my 
uncle's Ilgs with 1 meg of memory, two 5.25" 
drives (with write protect override switches, of 
course), two 3.5" drives, etc., and believe me, 
having Autoduel on one disk makes for a really 
neat game. 

To get AmDOS, I'd advise first requesting 
one of FPCL's free catalogs because they have 
quite a hefty shipping charge ($5.(K)), regardless 
of how many disks you order. It would be advis- 
able to get more than one disk, if you order 
directly from them. However, seeing that AmDOS 
is in the PUBLIC domain, send me a disk, a disk 
mailer, and about $0.45 to cover first-class post- 
age through the RDEX-editor, and I'll see to it 
that you get this program at no charge. Below is 
the address of FPCL. 

FPCL 

PO Box 1070 

Leesburg. FL 34749 

Here are some antique A.P.T.'s I recently 
obtained. If you have these programs, they must 
be in a single- load format; in other words, depro- 
tected and in a single file (as I demonstrated in 
COMPUTIST #58). 

Advanced Playing Technique for... 
SYZYGY 



Give yourself unlimited lives. 
BLOAD SYZYGY 
CALL-151 



297A:EA EA EA 



wasCED5 68 



BSAVE SYZYGY, A$0800, L$7800 

Advanced Playing Technique for... 
Tubeway 
Datamost 

For unlimited lives. 
BLOAD TUBEWAY 
CALL-151 

2083:EAEA wasC6A3 

BSAVE TUBEWAY, A$0900, L$87F0 

Advanced Playing Technique for... 
Ms.Pacman 



Give yourself 12 lives (it has to be a UTTLE 
challenging). 
BLOAD MS.PACMAN 
CALL-151 

285D:A9 0C wasA903 

BSAVE MS.PACMAN, A$17FD, L$48F8 

Icons instead of text? 

To the RDEXed: In COMPUTIST #68, you 
asked for some ideas on how to use some graph- 
ics in the magazine. As to the "Softkey for..." and 
the other lines preceding softkeys, APT's, and 
the like, I say leave it as it lies. It distinctly shows 
one in the magazine where the softkeys, APT's, 
and other sections are. Maybe underneath them 
you could print a title screen/screen dump, and 
have next to it the name of the product being 
cracked/APT'd/h.alf-keyed, the company, the 
company ' s address, and price, like you did in past 
issues of Hardcore Computist. 

As for the lock & key, skeleton key, etc., why 
not use a personification? For example, invent 
some little smurf-like gremlin with a name like 
'Hacker Jack', 'Disk Buster', or something like 
that, and for each softkey, maybe show him 
holding a flag of victory while standing over the 
fortress of a program's now crippled copy pro- 
tection, and for APT's, maybe have him use 
floppy disks with Uttle spy cameras which take 
pictures of the fort's defenses, and for half-keys, 
have him stand outside cursing his mouth off at 
the stubborn program? It might take somebody 
on the order of Rembrandt to draw artwork to fit 
something like this, but I think it might be worth 
a try if enough people put their heads together. 
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Concerning the question about what to call 
softkeys to programs with code wheels, pass- 
words, etc., why not call them Code-keys? They 
are, after all, keys to a code which prevents users 
from using the program. 

Also, what happened to the floppy disk with 
two ' by tes ' on each side which were endmarks to 
articles in the old days? 

Notes on E.D.D. IV serial number 

To "THF": In COMPUTIST #69. you asked 
about how to circumvent the displaying of your 
serial number in E.D.D. IV. I've got version 4.1 
of E.D.D. IV Plus, and I'm not certain if any 
major changes were made up till versions 4.8/4.9 
came out, but I'll describe how I eliminated the 
serial number in my version. First, I formatted a 
blank DOS 3.3 disk, and transferred my dcpro- 
tected file E.D.D. IV PLUS (softkey in COM- 
PUTIST #49, ppl6-18) onto the blank disk with 
a file copier, to isolate E.D.D. 's data from any 
other files. Then, using the scan textoption on the 
Copy II Plus sector editor, I scanned for the word 
'SERIAL', and soon I came upon that word with 
the serial number following soon after. Using the 
sector editor again, I replaced the serial number 
with all O's, and wrote the sector back to disk. 
That was it. Now, if you can't find the serial 
number on more recent versions of E.D.D., I'd 
suggest you try Phil Goetz's EOR DISKSCAN 
(COMPUTIST #57), which allows you to scan 
for data that has been encrypted on disk via the 
EOR (Exclusive-OR) conunand. If the serial 
number is in fact untraceable with a normal 
sector editor, then I'm certain it has been en- 
crypted. 

Apple Ilgs Virus Discovered 

Perhaps only the first of its kind? 

On October 3, my uncle (who owns an Apple 
Ilgs, and also resides in sunny Florida) called me 
up and told me detaib on a virus he had foimd 
sneaking around in his computer. He was run- 
ning on a disk from nibble Magazine when sud- 
denly he was encountered with messages like 
'CHECK STARTUP DEVICE" or "UNABLE 
TO LOAD PRODOS", along with a title screen 
which gave credit to the compu-genetic 'engi- 
neer'. Itcalled itself Lode Rurmer, the 'Premiere 
Virus' by Super Hacker Shyrkan, of the Master 
Cracking Service. The title itself was in English, 
but the rest of the message which followed was 
entirely in French. The hacker had also men- 
tioned, within the block of French text, that the 
virus was non-destructive; but' of course, as with 
all viruses, it was more than inconvenient. For 
any wary computists out there, this gremlin was 
found specifically on the ProDOS side of the 
August 1990 nibble diskette. It is possible to 
circumvent, but not eliminate, the virus, accord- 
ing to my uncle, by pressing Control-Reset 
immediately after the screen appears. 

If anyone has any information regarding this 
or other viruses, please share your info with 
COMPUTIST. 



part of the jwotection scheme (but I find it hard to 
believe that's all they did). This will at least yield 
a playable game so if you do find where/if it 
crashes please let me know. 



David Goforth 



WA 



Softkey for.. 



Distant Views 



Scott, Foresman Reading Courseware 

Distant Views is a series of 4 disks (both 
sides) that teach reading skills. Although the 
software comes with one complete backup, we 
all know how long that will last in a child's hands 
(as long as the original did, if we're lucky). 
Thanks to Wayne Zurow & Computist #67, 1 was 
able to back these up in about 15 minutes for a 
local grade school teacher. 

14 Sfil EiJa From I2 

$00 $0C $38-37 BD8C 18 60 

$01 $04 $63 FF DE 

$01 $04 $E1 FF AA 

The article in #67 said to scan the disk for BD 
8C CO 10 FB 88. 1 found the start of this string on 
Track $00, Sector $0C, Byte $36, $44, and $69. 
My first attempt (by changing ALL BD 8C's 
produced an unbootable disk,) ONLY the first 
location should be changed. Then to change the 
epilogs by searching for C9 FF. These were 
found only in one location (above). The article 
then mentioned searching for BO 01 and chang- 
ing it to EA 18. 1 found this on track $00, Sector 
SOD, Byte $83 and on Track $02, Sector S02, 
Byte $B8. 1 had originally changed these (at the 
same time I'd changed all the BD 8C locations) 
but removed them. These are supposed to be tied 
in with the reset however, when I booted the disk 
all worked well. It appears that this protection is 
on a lot of Scott Foresman software - just the 
location varies slightly. 



Bitkey for... 



Prince of Persia 



Broderbund 

I used Copy II-I- v9.2 (any 9.x version should 
work & possibly 8.x). Select Manual Bit Copy, 
Track S00-S22, Don't Keep length, and No Sync 
(all standard defaults). Copy both sides this way. 
I've only played it partway through the 2nd level 
so there is no guarantee that Broderbund didn't 
plant something further down the line because 
this did seem too easy. Altered address headers is 



The Wasteland Warrior 



FL 



Playing Tips for... 

Wasteland 
Electronic Arts 

•After you put him back together. Max will 
'reveal' to you the locations of Sleeper Base and 
Base Cochise. 

•All of Max's parts can be found within the 
sewers under Las Vegas 

•ALWAYS have at least one length of rope 
BEFORE deciding to use the chopper to fly to 
Base Cochise; otherwise, you'll discover that 
after losing around nine-tenths of your hit points 
to Wire-Guided Anti-Persoimel Missiles, Tita- 
nium Crawlers, Vanadium Vultures, X-ray Pro- 
jectors, and Gauss-Needle Projectors, you won't 
be able to enter the base! First, you need to blow 
a hole in the upper level, then DESCEND using 
the rope, so if you don't have one, you're stuck at 
the top FOREVER! 

•In COMPUTIST #60, John E. Wanner gave 
an excellent APT for Wasteland. It seems, though, 
that he overlooked a very useful piece of info. 
When you enter the Temple of Blood in Needles, 
and decide to 'play' their game, say '30' when 
you reach the robot, and then you'll discover 
you're transported down into a location with an 
island surrounded by a large moat Swim across 
to the island, go aroimd the island and pick off all 
the snipers, and collect their gear for later sale. 
Then, blow the entrance to the main building, 
jump over the pressure plate, and waste EVERY 
SINGLE patrol that comes after you. I've gotten 
more than 19 LAW rockets, 30 Howitzer shells, 
and dozens of clips of 7.62 mm ammo all at once. 
These will come in very handy for the assault on 
the Citadel. By the way, if you need (or want) 
more goodies from here, just make a fresh copy 
from your original of side 2, and re-raid Ihe 
arsenal! 

•To David Stewart: re. how to operate the 
cloning machines (COMPUTIST #72). Here are 
the steps to follow: 

1 . Assuming you have access to Sleejjer Base, 
acquire cloning tech skills in the level 1 library. 

2. Go to level 2 in the room with the Chemical 
Synthesizer. 

3. Run a diagnostic check. 

4. Have the character with cloning tech (U)se 
cloning skills to correct the chemical imbalance. 

5. Go to the far east room and take an empty 
glass jug. 

6. Go back to the Synthesizer room. 

7. Choose the Install Manual Outflow Device 
option, and after the message, (U)se the jug on 
the nozzle. 

8 . Choose Create Clone Fluid, and the jug will 
be filled with, what else, clone fluid. 

9. Take the jug and go to the chamber with the 
clone pods. 

10. Disband the member you want to clone 
with the jug of clone fluid, and have him/her enter 
a chamber. 

1 1 . Wait for 2 days or so, and you should have 
an exact duplicate of yovu' character at that time. 
This is an OK way to replicate members of your 
party as a precaution in case they get wasted, but 
make sure you have a slot to fill in your roster if 
you intend to have a clone tag along. 



Jerry L Kynsi 



WA 



Softkey for... 
Where in Time is Carmen Sandiego 
Broderbund 

Requirements: 

Apple Ilgs 

3.5" disk copier (Copy n Plus, etc) 

One 3.5" drive 

One 5.25" drive 

The deprotect can be done either before you 
put the program on a 3.5" disk or after. The pro- 
tection scheme is in the "MH" file. It is on side C 
of the 5.25" disk. 

On the 5.25" disk, the sector to fix is on track 
S20, sector $01. Change byte SOO from SAD to 
S60 and write it back to disk. That is all. I have 
played the game for quite awhile and haven't 
found any problem. In case there are different 
versions, the bytes to search for are AD 30 BF. 
Change the AO to 60. 

Installing Carmen.Time on a 3.5" disk 

To put the program on a 3 1/2 disk, use the 
'HARD DRIVE INSTALLATION' feature on 
the disk. Format a blank 3 1/2 disk with any name 
but, "CARMEN.TIME". Then, boot up SIDE A 
of the 5 1 /4 and when the first graphic of Broder- 
bund crowns starts to sparkle, press esc. You will 
be prompted to select the destination volume. 
Use the name you gave the blank disk and press 
return. The number of files to be copied will be 
displayed. You will be prompted to insert side B, 



C and D as the files are copied onto the disk. A 
message will appear when the installation is 
complete. 

Then, search the disk for bytes AD 30 BF and 
change the AD to 60. Write the block back to 
disk. On my disk, the block to change was $29D, 
byte $00. Rename the Volume "CARMEN 
.TIME". 

Good luck finding Carmen. 



Bob Igo 



PA 



There were errors in the APT for Elite in 
Computist #70. For the 25 .5 light year fuel capac- 
ity, change $6F0E from $46 to $FF. I'm not sure 
what the LDA #SFF is supposed to do; on my 
version, it was LDY anyway. Also, the code for 
multi-galactic jumps must be started at S6BAF, 
NOT $6B AE. If the technique in issue #70 worked 
for you, then you must have a different version 
than I do. 



Advanced Playing Technique for... 
Thexder //e 
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Advanced Playing Technique for... 
Berzap 
9 

Number of lives. 

Ids Ssl ByM From la 

$06 $00 $6E 03 FF 

$04 $0C $98-9A CE44 03 EAEAEA 

Does anyone know how to edit the Data East 
double hires games like Bad Dudes, Heavy Bar- 
rel, Victory Road, etc? They've left me rather 
clueless and armoyed. 

If you've got a color composite monitor like 
I do and are tired of playing double hires games 
in a greyish-white monochrome, try this: 

Before booting the game, type the following: 

CALL-151 

C050 

C057 

C054 

COSE 

COOD:00 

C05F 

COSE 

C05F 

COSE 

(place pre-wrilten magnetic software media (okay, the 

disk) in the drive and type:} 
C600G 

That turns on double hires (COSE) and then 
turns it off (C05F) and on twice which changes 
the mode from monochrome to mixed mode to 
full color mode. C600G boots the disk in the 
drive. Why do these games not run in color 
normally on color composite monitors? I don't 
know. If you have an RGB , the monochromicity 
should give you no trouble. There is one good 
thing about the above problem; you are now free 
tomakeyourselfamonochromeversionof Dazzle 
Draw. Just search on a sector editor for any 
reference to $C05F and NOP it with EA's. This 
way, you can draw detailed monochrome pic- 
tures with no trouble, a nice option to be used in 
conjunction with ThunderscanorComputer Eyes 
or the like. Be sure to switch the COLOR option 
OFF or you'll just get fat monochrome when 
drawing with the paintbrush instead of smooth 
lines. If youcan'tfigure it out, contact me through 
the magazine and I'll help you out. 

©Does anyone have any questions about my 
editing software which was on the library disk of 
issue #70? Any love letters or hate mail about it? 

Well, unless I run out of games to edit, I'll be 
writing again soon. 



Matthew Bancroft 



MA 



Readers Data Exchange 



Softkey for... 

FAYrThat Math Woman 
Didatech 

I made a copy of Fay with Locksmith Quick 
copy. Then I booted my copy and it did not work, 
it just jumped to DOS. So I decided to look for a 
jump to BASIC either 4C 00 EO or 4C 03 EO but 
I had no luck. When I started investigating fur- 
ther I discovered that the file FMWS was junk. 
This lead me to believe that it was encoded 
because I could not find the Menu words any- 
where on the disk. So, I decided to decode the file. 
I started looking through the Hello file and I came 
across ajump to BCEl wheni put a4C 59 FF in 
its place and jumped to the begirming of the 
startup file it loaded the program and the decoder. 

Inow examined the code at BCEl andlfound 
a routine that EORed the value at 6000 and 
seemed to decode abig portion of memory . Then, 
there was ajump to B A89, and at B A89 there was 
ajump to the code it had just decoded. I replaced 
the jump to the code it had with a 4C 59 FF. 

Then, I jimiped to BCEl and I waited a Uttle 
while and then the monitor prompt was back. 

15 



When I examined the code a 6000 it was totally 
different so I had a pretty good idea that this was 
the FMWS file that had looked like junk. So, I 
saved it back as FMWS. 

Then I started looking through the decoded 
code and I found it turned on the drive and looked 
for some things. So in conclusion I NOPED the 
bytes at 671B from a jump to the routine to reset 
the change vector and clear memory and then 
jump to dos (4C D3 66) to EA EA EA. Now if I 
jumped to BA89 the program would have Fay 
move across the screen but when in the middle 
she would get stuck and build a duplicate of 
herself and have the duplicate hop across the 
screen. Then, when I got to the actual game Fay 
was bricks. So, I had half accomplished cracking 
it. 

Then I bloadcd my decoded file and more 
closely examined it. This lead me to change my 
EA's and the two bytes in front of it to a load the 
accumulator with a 98 and a JSR to 8828. Now I 
had to tell the HELLO not to decode the FMWS 
file any more. To do this I changed 846 to a jump 
to BA89. 

Step-by-step 

1. Make a copy with a copier that ignores errors. 
I used locksmith quick copy. 

2. Boot a normal DOS disk then insert the FAY 
copy. 

BLOAD COPYRIGHT 1986 

CALL-151 

846 :4C 59 FF 

802G 

3. Let the title screen appear and right after it 
appears the text screen will appear and the 
monitor prompt will appear. If this does not 
happen repeat steps 1 & 2. 

BA92:4C 59 FF 

BCE1G 

671 B :A9 98 20 28 88 change the code 

A851G Now reconnect DOS 

BSAVE FMWS, A$6000, L$3580 

4. Boot a slave disk then insert the FAY copy. 
BLOAD COPYRIGHT 1986 

CALL-151 

846 :4C 05 67 

BSAVE COPYRIGHT 1986, A$802, L$16C 

Now you are finished. 

Softkey for... 

FAYtThat Word Hunter 

Didatech 

It is basically the same principle to deprotect 
the Word Hunter as i t is to deprotect the rest of the 
series. Here is what I recommend you do: 

1. Make a copy of the Fay disk ignoring errors. 

2. Boot a 48K slave, insert the Fay disk. 
BLOAD COPYRIGHT 1983 
CALL-151 

885 :4C F2 6B 

BSAVE COPYRIGHT 1983, A$802, U1D1 

885 :4C 59 FF 

8Q2G 

3. Let the title screen appear and then the monitor 
prompt (*). 

BA92:4C 59 FF 
BCEIG 

8567:A9 FE 8D 2A 85 EA EA EA EA EA dis- 
able protection check 
9DBFG Reconnect DOS 

BSAVE FWH, A$6002, L$39DF 

Now You are Finished 

Softkey for... 

FAY: Word Rally 

Didatech 

I thought I had cracked this one but when I 
played it, it would reconnect DOS and jump to 
BASIC. Finally after searching memory for the 
code that jumped to BASIC, I found another 
check which would jtunp to BASIC. After chang- 
ing some code around it and the actual jump, it 
seemed to function great. But if it doesn't please 
get in touch with me and let me know. 

Step-by-step 

1. Make a copy with a copier that ignores bad 
sectors. When you copy the Didatech software 
that I have mentioned in my article you should 
only have one unreadable sector on the whole 
disk. 

2. Boot the original and when the prompt appears 
press control reset 

BLOAD FWR 
CALL-151 
BA92:4C59FF 

BCEiG call the decoder 

86F1 :A9 FE 8D B4 86 EA EA EA EA EA dis- 
able prot 
7A93:8D F5 86 EA EA EA EA EA disable prot 
UNLOCK FWR 
BSAVE FWR, A24576, LI 3817 

3. Now tell the hello not to use the decoder. 
BLOAD DV 

CALL-151 

934 :4C 93 78 

UNLOCK DV 

BSAVE DV, A$802, L$15C 

LOCKDV 

LOCK FWR 

Now you are finished! 

Notes on Cross Country USA (Didatech) 

I have foimd that if you leavie a fiilly function- 
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ing deprotected copy of Cross Country USA out, 
it will get stolen. I figure the main reason that 
most people would like to deprotect 'USA is to 
decode the files. I have devised a method so that 
you can change the words throughout the game 
without deprotecting it. 

1 . Make a working backup of the original disk as 
described in issue #52, pg 17 by Jim Bancroft. 

2. Now boot a 48K slave and insert the original 
Crosscountry USA disk. 

UNLOCK COPYRIGHT 1985 

UNLOCK P2 

BLOAD COPYRIGHT 1985 

3. Use the decoder to decode the P2 file and then 
save it back to the copy. 

927 :4C 59 FF 

BLOAD P2 

BA89:4C 59 FF patch decoder 

BCEIG setup decoder 

90FG decode P2 

90D:EA N 90E<90D.925M dump decoder 

A851 G reconnect DOS 

4. Insert the copy disk and save the files. 
BSAVE COPYRIGHT 1985, A$802, LS36F 
BSAVE P2, A$4000, L$562F 

LOCK P2 

LOCK COPYRIGHT 1985 

This will leave you with a copy on which you 
can change the words throughout the game. 

Cracking the SSPR0T$1 protection 

I have produced an SSPROT decoder that will 
decode the widely used Applesoft protection 
system in the SSPROTSl file. I call it SSPROT 
protection because there are two files on this disk 
called SSPROT and you BRUN SSPROTSl to 
get the program started. This protection has been 
used at least for 8 years and is a pain in the rear. 

SSPROT HELLO DECODER 

1 . To use their decoder (slightly modified) enter 
the following code: 

CALL-151 

300:A9 01 8D CF 03 A2 68 18 
308:90 00 A9 08 85 68 A9 01 
310:85 67 AD FF 07 85 BO AC 
318:FE 07 A9 00 85 AF 85 FF 
320:A5 FF 51 AF 4D CF 03 91 
328 :AF 45 FF 85 FF EE CF 03 
330:88 CO FF DO EB C6 BO A5 
338:B0 C9 07 DO E3 AD FE 07 
340:85 69 85 6B 85 6D 85 AF 
348: AD FF 07 85 6A 85 6C 85 
350 :6E 85 BO 6C F2 03 
BSAVE SSPROT.DECODE, A$300, L$5C 
3 DOG 

2. Make a copy of the original disk by ignoring 
epilogs and all of track 3. 

Note: In some SSPROT disks the VTOC on 
track 11 sector does not point to track 1 1 , sector 
OF with its catalog link. If that is so, cataloging 
from NORMAL DOS gives an I/O error. Sector 
edit their VTOC to point to track 11, sector OF. 

3. Using the copy disk, load the encoded Apple- 
soft HELLO file and decode it. 

BLOAD SSPROTSA protected file 

BRUN SSPROT.DECODE decoder 

4. List your file to see if you've captured the 
Applesoft and if so reconnect DOS and save. 

CALL 1002 
SAVE HELLO 

Now if you have another disk to do, follow the 
same procedure. You don't have to bother 
BRUNning the decoder since it is already in 
memory. You only need to tyj)e CALL 768, after 
BLOADing the next SSPROT$A file, to activate 
it. 

Softkey for... 

French Hangman 1 & 2 



This program was a very interesting one to 
crack. When I had convertol it to normal DOS 
and run the file called MENU it would tell me: 
COPYRIGHT 1983 BY GEORGE EARL 
1302 S. GEN. MCMULLEN, SAN ANTONIO, TEXAS 
ALL RIGHTS RESERVED - AS A COMPETENT 
PROGRAMMER, YOU SHOULD TRY TO RESPECT 
OTHER PROGRAMMERS RIGHTS 

This was cute. Then I noticed an unusually 
long Applesoft file. I got into Integer BASIC and 
tried to run it but was unsuccessful because my 
DOS and Integer BASIC were at the wrong 
place. Since this program ran on 48K, Integer 
BASIC could not be in the upper 64K. This meant 
I would have to make a 32K slave. Finally after 
reading the article in issue #27, pg 29, 1 found out 
how to do it. Here is what I finally did: 

Step-by-step 

1. Convert French Hangman 1 & 2 to normal 
DOS 3.3 buy ignoring the epilogs on the DOS 
3.2 disk. I recommend changing your DOS 3 .2 
RWTS to ignore epilogs and then using 
DEMUFFIN PLUS. 

2. Copy tracks SOO-02 from the DOS 3.3 System 
Master. Tell DOS that it is running at the 32K 
location by sector editing track $00, sector 
SOA, byte S04 from BF to 7F. 

3. Copy the Integer BASIC file and 
LOADER.OBJO from your DOS 3.3 system 
master. 



4. Write the hello file as follows and save it back 
as HELLO. Note: change line number 30 
according to the FRENCH HANGMAN 
number. 

French Hangman HELLO 

10 TEXT: HOME 

20 VTAB 13: HTAB 10: PRINT "THEOFRENCH 

OHANGMAN" 
30 VTAB 19: HTAB 15: PRINT "LOADINGO(I)" 
40 D$ = CHR$ (4): REM CTRL-D 
50 PRINT D$ "BLOADOLOADER.OBJO" 
60 CALL 4096: REM FAST LOAD INTEGER BASIC 
70 PRINT D$ "RUNOAPPLESOFT" 
80 END 



Checksums 



70-$1946 
80-$5639 



10-$FB33 40-$H00 
20-$C924 50-$B271 
30-$F8EA 60-$54B7 

There is also a way that is kind of dirty in THE 
PREMIER ISSUE OF MICROZINE to make it 
run on the IIE enhanced. I removed a jump to 
subroutine at 805. This JSR was at SC5E in the 
file HCRG. But in doing this, the screen turns to 
garbage in the "poster option". It appears that this 
jump is needed in this poster file. But, I am not 
really interested enough to care about fixing the 
bug. 



Groucho 



PA 



Wow, have I got a lot to talk about this time! 
I hope you'll all bear with me. 

First of all, I finally got my ROM modifica- 
tions accomplished. Thanks to Don Lancaster's 
"Absolute Reset" package and the great article 
by Wes Felty in Computist #34. 

I have a "platinum" Apple lie, which I pur- 
chased not very long ago. In this machine, all of 
the Monitor ROM is located in a single ROM 
chip located on the motherboard, and identified 
by the label "CF ROM". This chip incorporates 
the old CD and EF ROMs, which I beUeve 
contained the CO, C8, DO, D8, EG, E8, FO, and F8 
ROMs. To force the He to reset into the monitor, 
this chipmust be replaced with a27128EPROM. 
An EPROM is a chip which acts like a ROM, but 
unlike a ROM, can be erased (via ultraviolet 
Ught) and programmed (with an EPROM pro- 
grammer). Thus, by reading our original ROM, 
and creating a new EPROM with a modified 
version of the code stored in that ROM, we can 
change how the Apple handles Reset, Control- 
Apple-Reset, etc. 

The first step in the modification (for me) was 
to purchase Don Lancaster's Absolute Reset 
package for Si 9.50 from Synergetics (Box 809 - 
746 1st Street, Thatcher, AZ, 85552). This pack- 
age included a disk with some programs and text 
files on it, and a couple of pages of printed 
documentation. In my opinion, the quality of the 
printed documentation was fair to poor, and the 
documentation on disk was largely accurate, but 
because my machine was relatively new, not 
100% on target. This package mentioned that I 
could have an EPROM prograiruned by a com- 
pany called E-Tech. I followed the directions in 
the package and wrote to E-Tech to learn that 
they were out of business. So I did the next best 
thing. 

I purchased a "PROMgrammer" from South- 
em California Research Group (P.O. Box 593, 
Moorpark, C A 93020). The price was on the high 
side, about S 150. Hopefully you will have access 
to a PROMgrammer (or similar device) via a 
fi-iend. If not, drop me a line. I'd be glad to 
program an EPROM for you. I'm hoping to 
recoup the cost of my PROMgranmier by helping 
out other readers with the same problem. Write to 
my address at the end of this article for more 
information. 

After purchasing the PROMgrammer, I or- 
dered some back issues of Computist, which 
detailed additional modifications I might want to 
make to the original ROMs. Since my machine is 
relatively new, many of these mods were already 
incorporated in the design. However, one very 
useful note was given in Wes Felty' s article. It 
seems that when Don Lancaster's patch is in- 
stalled, the next time you hit reset (after resetting 
into the monitor) you will find yourself rebooting 
the disk. The mods Wes suggests obliterate the 
Tape Load function, but since 1 have never used 
the cassette for anything, I decided the loss was 
acceptable. 

So, after incorrecdy programming my first 
EPROMs, I ordered an EPROM eraser (also not 
cheap, mine was S40). The first thing I did was 
mistakenly destroy the chips by putting them in 
upside down (it pays to read the directions! 
honest!). So I ordered more chips. They are about 
S4.25 each from JDR Microdevices. 

Then, I ran the program on Don Lancaster's 
disk which makes a copy of the CD and EF 
ROMs to disk. The reason you need a sp>ecial 
program to read the ROMs relates to the Apple's 
hardware design - some of the addresses in the 
ROM double as peripheral card communication 
points reading the addresses in this range can do 
things like turn on your disk drives. The 
"SN ATCHMON" program creates 4 files on the 
disk. One file contains die code from SC(X)0 to 
SCFFF, one with the code fi-om SDOOO to SDFFF, 
one with the code from SEOOO to SEFFF, and 
another with the code from SFOOO to SFFFF. 
Lancaster's patch resides in the SCOOO-SCFFF 



portion, and replaces the code that re-boots the 
system when you press "Open-Apple-Control- 
Reset". With the patch installed, you press the 
"Open- Apple-Control-Reset" key combination, 
and release all but the "Open-Apple" key. Con- 
tinue holding that, and the system pops into the 
monitor. Release it before it pops into the moni- 
tor and it will reboot, as before the modification. 

On the whole, it is a really neat modification. 
Lancaster and Felty even made sure of one other 
point. If I press "Option-Control-Reset" (i.e., 
"Closed-Apple-Control-Reset") to do the "diag- 
nostic" check, it comes back "System OK". In 
other words, even the Apple doesn't know the 
patch is there. And I have yet to see the program 
that can defeat it. 

I am considering other ROM mods. If anyone 
knows of a neat one, please pass it along. I am 
also looking for a used Senior PROM, CIA files, 
or Bag of Tricks. 



Playing Tip for.. 



Wasteland 



Readers Data Exchange 



Now, onward to another topic. Electronic 
Arts' incredibly complex "Wasteland". 

Here are a few tips to help you solve some 
puzzles: 

Early in the Game: If you need cash quickly, 
develop a psychotic, detached attitude. Create a 
new player you want to keep, and three you don't, 
at the Ranger Station. Make the three you don't 
want trade their guns to the one you want to keep. 
When that player's inventory is full of gims, 
create a second player you intend to keep and two 
you don't. Do the same thing again. Trade the 
guns of the unwanted players to the player you 
want to keep until he has no more room. Create 
a third, etc. Eventually you'll have three loaded 
down players and one empty one. Walk to the 
nearest village and sell all the guns and buy better 
weapons (like M19 Rifles, etc.) and armor. Now 
you're actually ready for some batde. I've found 
that, in general, the most successful characters 
are those with the broadest range of skills. 

Later on: As you acquire newer and better 
weapons, make sure you use those promotion 
points (you did Radio, didn' t you?) to acquire the 
skills to fire them at your local library! Using 
Assault Rifles without the skill will limit your 
ability to hit - severely! Missiles and Rockets 
require AT Weapon skill, Uzis require SMG 
skill, M19s require Rifle skills, etc. 

Nomad's Camp: Tell the bodyguard at the 
leftmost tent "CATERPILLAR". He'll think you 
solved another puzzle somewhere in the game. 
Watch out for the middle tent. 

Agricultural Station: This is a good problem 
solving exercise for "green" players. Go into the 
Ag Station and kill Harry the Bunny Master for 
them. They'll offer you a trip into the root cellar. 
Make sure you use your perception skill on 
everything. Many goodies are tucked away there. 

Romcards: Don't throw them away. They're 
rare and you might see a use for them someday. 
SERVO MOTORS are the same kind of deal. 

DarwinBase: Opens with SecPass 7. You get 
this from the Sleeper Base. You get to see the 
sleeper base when you make use of the ROM- 
CARDS and SERVO MOTORS. Where? That's 
your problem. 

Conveyor Belt: Control unit doesn't respond 
well to a heavy hand. 

APT: If you manage to "kick some butt" and 
acquire some really neat loot, some neat loot like 
Power Armor or a NATO Assault Rifle, that 
there isn' t enough to go around, DON'T PICK IT 
UP! Instead, save the game. Make a copy of the 
diskthatwasinthe drive at the time you found the 
neat goodies. Reboot and collect the goodies. 
Save the game again. Reboot and collect the 
same goodies again. You can do this as many 
times as needed. Thus, a single assault rifle could 
belong to everyone in your party. 

Sleeper Base: The party splitting feature and 
the power controller will let you get past some 
storms brewing elsewhere on the base's level 3. 
An android will do even better! To fix helicopter, 
you need a ROMCARD. To fix the power regu- 
lator, you'll need a power converter, which the 
base commander knows about it. Don't drop 
secpasses. Turning power off and on can prove 
usefiil, and certain indestructible shields are no 
big thing. 

BrokenToasters: Fix them with the right skill 
and the workbench in the Citadel. You'll get 
some additional "junk" items that way. 

Clone Technology: This skill actually has a 
purpose in the game. Need a new player? Clone 
him. In one of the bases is a cloning machine. Use 
the chemicals and your skill hidden in the hotel to 
adjust the fluid levels. Catch the fluid in a jug and 
go back to the clone machine. Put the fluid and a 
disbanded player in the machine and eventually 
a clone will come out. I haven't done anything 
with one yet, but I assume he will be an NPC with 
all the skills/qualities of the original character. 
Drop me a line and let me know what you find out 
about cloning. 

The Guardian Citadel: You need to be well- 
armed for this one. My expert younger brother 
recommends at least an Armor Class of 10, 
Assault Rifles, Explosives, and Rockets. There is 
a chink in the Citadel's armor. Walk close to the 
"barbed wire" walls to find a spot not as tough as 
die rest. Blow it to bits. Then you're taking the 
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back way in and surprising the heck out of the 
Brothers and Sisters. And don't forget, you can 
"nickel and dime" your way into the Citadel. 
That is, drop a Brother or two, go out and build up 
strength, drop a few more, go out, etc. Eventually 
the base is yours and no one had to die for you to 
get it. You could even go and stock up on goodies 
at the weapons shops. 

The Jailer's photon axe is great for opening 
doors here - but nowhere else. Certain important 
passwords are hidden throughout. 

Tables: Things written on them can often tell 
you secrets and answers to questions you never 
dreamed possible. To see what I mean, visit the 
men's room at the bar. Talk to the guy there. Ask 
him about Ugly, and every other thing he men- 
tions, as well as every person. What you learn 
could surprise you, especially what he knows 
about other patrons of the bar. 

Finster: Kind of a Benedict Arnold. Don 't let 
his face out of your sight. There are times when 
it (the face) comes in handy. You'll need the 
Cyborg Tech skill at that time. (And you'll wish 
you had a Vorpal sword...) 

Safe: To open a certain safe tucked away near 
the bam, you'll need to bump off Huey, Dewey, 
and Lxjuie. They've got some jewelry that holds 
the "key" to opening the safe. 

Highpool: They have a pump problem that 
could be fixed with some merchandise from the 
Nomad's general store. While you can perform a 
rescue in the cave the little boy tells you about, 
you'll alienate him in the process. 

Cochise Base: You'll want to be VERY, 
VERY, heavily armed to bust in here. Meson 
cannons and Ion Beamers are recomnjended - 
nothing less than a laser rifle should even be 
carried in (not even a laser carbine). Your power 
armor will barely work. Ask the computer termi- 
nal about FINSTER and about the MISSION. 
LAW rocket gets you past the first gate, and 
SECPASS gets you past the second. To get to the 
lower levels of the base, go up the escalator and 
go left or right and will come to a wall - part of 
which is hollow and can be opened. You'll need 
rockets to open doors - little else will work. RUN, 
and get an ADMIN robot when you get the 
chance. Smash iip the security monitors and 
robot controls, unless someone reports a better 
idea in Computist. Various keys come into play 
on the third level. You'll want to bring a plasma 
coupler with you too. Make sure you have some 
Rad Suits. Never play with Security Monitor 
Intervals unless you like firefights. 

Max: Needs some servo motors, a fusion cell, 
romcards, an android head, and a power conver- 
ter. Max awaits under the Mushroom Church. 
Don 't touch the reactor unless you enjoy the heat. 

That's all I have for Wasteland. If you have 
anything else, or would like some more specific 
directions on ho w to get around any of the puzzles 
above, drop me a line. I'd be glad to walk you 
through them - by mail, or phone if necessary. 



Playing Tip for.. 



Neuromancer 



Bank Gemeinschaft: open an account 

Avoid Straylight Villa at Freeside. 

Don't volunteer for experiments, costs S in 
the long run. 

Might as well give Armitage your BAM A ID. 

Crazy Edo wants one of the hotel's "wares". 

Shin's got your (puny) comlink. 

Go all out for the best Cyberdeck there is . . .you 
need it! 

Cyber Deckware can go bad, always have a 
BACKUP!! 

I still haven't solved this one, either. Let me 
know if you're working on it too. We can com- 
pare notes. 

Advanced Playing Technique for... 

Rescue Raiders 

Sir Tech 

For those of you who hate having only three 
lives, you might like to increase the ntimber of 
lives available to you. Pull out my friend Bob 
Igo's Editor Creator 11 and create an APT pro- 
gram which does the following sector edit for 
you: 



Trh Set Byte 


From 


IQ 


OC OA D6 


04 


FF 



The "to" value should be the number of lives 
you want to have. Normally you'll have four, but 
you can have as many as you want. Unfortu- 
nately, there can be no "unlimited" lives, since 
when you change the "right" code you find that 
you only have ONE life... not too cool. 

For those of you who have missed the other 
edits, I'll re-print them here. 

Unlimited Bullets: 

Ids S£l Bi^ From l2 

$0F $04 $26-28 DEF6 60 EAEAEA 



Unlimited Bombs: 

Ids Sd Byie From I2 

$0F $04 $9C-9E DEF4 60 EAEAEA 



Unlimited Missiles: 



Ids Ssl Bm Emm 

$0F $06 $37-39 DE02 61 
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I2 
EAEAEA 



While whatlread says that changing track OF, 
sector 04, bytes 2D and 2E from FO E3 to E A E A 
will give you Napalm instead of bullets, and it 
appears to be correct, it will also cause the game 
to crash impredictably. Let me know anything 
you discover on this one. 

Well, I think that about covers it. For more 
information on Wasteland, Neuromancer, or 
ROM mods, drop me a line. (Or watch for my 
next article in Computist.) My address is: 

P.O. Box 200-X 

Sewickley. PA 15143-0600 

I answer any and all letters sent to me, even if 
I can't answer all the questions in them. Feel free 
to write! 



Jim Ross 



NH 



Softkey for... 

Dungeon Master 
FTL 

Requirements: 

Apple Ilgs 
Copy n-t- v9.0 
Blank 3.5" Disk 

I submitted a previous article on a bitkey for 
Dungeon Master. I had played several hours into 
the game and saved several times before I sub- 
mitted the article. Subsequently, further in the 
game I went down a set of stairs, the disk drive 
came on and my copy crashed within a few more 
minutes of playing time. I then started looking for 
this additional check. The check is well hidden . 
If you go down the stairs and the disk drive read 
is made it will not do it again if you go back up 
and then down the stairs. It seemed to take about 
20 minutes of playing before this stair check 
would re-arm itself . I' m not sure if this re-arming 
is based on time or number of moves in the game. 

After many hours of searching, I did find this 
subroutine and the branch statement right after it. 
NOPing out this branch statement killed the stair 
disk check and I have played another 20 hours in 
the game with no further problems with the 
game. It turns out the stair check calls the same 
SMARTPORT routine to read block $17 that I 
discussed in my previous article. Armed with this 
info and some guesswork, I managed to make a 
softkeyed disk. 

The disk first reads in block $ 17 using GS/OS 
DREAD and checks for a $27(1/0 ERROR) 
retumed in the accumulator. The interesting thing 
about DREAD is that it will read the data and put 
it in memory even if there is an I/O ERROR. 
Later block $17 is read again using the 
SMARTPORT call of JSR C50D. The stair check 
in the game would read block $17 again using a 
SMARTPORT call and the verify that the data 
was different (because of extra zero bits on data 
in block S 17). If it wasn't, it changed some key 
memory locations causing the game to lock up or 
crash. (This code is in bank SOI .) 

0FE8:22 712901JSL 012971 Has enough time or 
moves passed to arm? 
YES-dear carry, NO-set 
carry 
0FEC300C BCC 0FF1 (+03) branch if YES 
0FEE:82 8A00 BRL 107B|+008A} bypass stair chk 
0FF1:AE292F LDX 2F29 start of stair chit 

To make a softkeyed disk three things are 
necessary; 1) when the GS/OS DREAD is made 
push $27 in the accumulator so the program 
thinks block $17 is a bad block. 2) disable the 
stair check by NOPing out the branch statement 
which causes a jump to the SMARTPORT read 
routine 3) reverse the clear carry with the set 
carry in the disk save routine so you can save 
games. 



Step-by-step 



1 . Format a blank 3.5 disk using Copy II-i- v9.0. 
Enter "Y" when it asks tise high speed inter- 
leave and name the volume anything (I used 
"X"). 

2. Using copy disk (not copy disk with format) 
copy the original to your copy (ignore read 
error on block $17). Copy II-H will correct the 
checksum and write a good block $17. 

3. Using Copy n-h sector editor make the follow- 
ing sector edits: (I have included enough bytes 
before and after the edits so you should be able 
to find them it not in the same location) 

Blk Bvte From To 

SDC $83 00 27 

The hex string to search for is: 68 8F 34 08 00 
22 A8 00 El 00 00 00 00 00 00 BO 03 A9 00 00 
8F 02 00 02 AF 51 08 0048 8B AF 50. Change 
the A9 00 00 to A9 27 00. 

Blk Bvte From To 

SFE S6F-70 90 03 EA EA 

The hex string to search for is: 38 ED 50 02 48 
8A ED 52 02 AA 68 22 71 21 00 90 03 82 8A 00 
AE 50 00 AD 4E 00 186901 00 48 8A. Change 
90 03 to EA EA. 



Blk 
$104 



Bvte 
SllO 
S114 



From 

18 

38 



To 
38 
18 



Thehexstringtosearchforis:2529 IB IBFO 
01 E8 88 88 10 E9 EO 00 00 FO 04 18 AB 2B 6B 
38 AB 2B 6B 78 C2 30 8D C2 14 E2 20. Change 
18 AB 2B 6B 38 to 38 AB 2B 6B 18. This swaps 
18 (CLC) with 38 (SEC). 



Your copy should now work. However, if you 
made saves with the bitcopy in my previous 
article, your save disk is polluted and you must 
start the game over. Sorry about that! 

Note: I have tried this copy technique several 
times and have always made a working backup. 
I have not yet solved Dimgeon Master so I'm not 
sure there are not more disk checks, but so far, 
since I killed the stair check, my softkeyed disk 
has played flawlessly. 

Softkey for... 
Where in Time is Carmen Sandiego? 
Broderbund 
Requirements: 

Apple Ilgs 

Copy n-i- 

Original 3.5 disk 
Blank 3.5 disk 

Think this disk is not copy protected? Think 
again! After you finally solve one of their very 
tough cases, you are asked to insert the original 
3.5" disk before it will update your detective 
record. Sneaky! Anyway, the check is a JSR 9600 
followed by a BCC (branch on carry clear). A 
copy returns a carry set from this subroutine 
while the original returns a carry clear. I NOPed 
out the subroutine and changed the BCC to BRA 
and it worked. 

00/7190:20 00 96 JSR 9600 
00/71 9F:90 25 BCC 71C6K251 

Step-by-step 

1 . Copy the disk normally (I used COPY 11+ copy 
disk with format). 

2. Sector edit as follows: 



Blk 


Bvte 


From 


To 


S32B 


$19C 


200096 


EAEAEA 


S32B 


S19F 


90 


80 



Softkey for... 

Gnarly Golf 
Fanfare 

Requirements: 

Apple Ilgs 
Copy n+ 
Original 3.5 disks 
2 blank 3.5 disks 

The original program disk has a bad block on 
the last block S63F. Inspection using Copy II-i- 
Nibble Editor revealed data on this block with the 
data prologue changed from D5 AA AD to AD 
AA D5. Using Sector Edit search, I found on 
block $15D where the data prologue is changed 
in ProDOS (just before a READ BLOCK of 
$63F). 

Incidentally, block S63F contains the graphic 
data for the Mouse cross that appears to change 
ball color at the slot machine and is used for 
Mouse aiming in the game. 

Step-by-step 

1. Copy both the program and course disks nor- 
mally (ignore read error on program disk). 

2. Manual Bit Copy track S4F using COPY l\+ 
with parameter SOB changed to $02. 

a. Select Manual Bit Copy. 

b. Select begirming track S4F. 

c. Select ending track $4F. 

d. Select synchronize tracks? N. 

e. Select keep track length? N. 

f. Press "r key. 

g. What parameter? Enter SOB. 
h. What value? Enter $02. 

i. Press RETURN to begin copy. 

j. When side 1 is read, press "Q" and side 1 will 
write. 

k. When side 2 is read, press "C" for CHANGE 
NIBBLES. 

1. Change the data prologue on block $63F from 
AD AA D5 to D5 AA AD. 

m. Press "Q" and side 2 will write. 

3. Use the COPY H-h SECTOR EDITOR to make 
the following changes to the program disk 
only: 

Blk Bvte From I2 

S15D $93 9F 00 00 El EA EA EA EA 

S15D $9D 9F 02 00 El EA EAEAEA 

The program disk is now copyable normally. 
The course disk always was. Enjoy! 



Steve Kalvnuik 



Canada 



I am not sure if a softkey has been submitted 
for'OilBarons'byEpyxl983asIhavenotfound 
it in back issues, therefore here is my softkey: 



Softkey for... 



Oil Barons 

Epyx 



1. Format 2 diskettes using Copy II Plus (I used 
v8.3). 

2. Boot your altered disk from Computist #63 , pg 
17. 

3. Run a program like Blackstar or FID. 

4. Copy all programs on side 1 to diskette 1. 



5. Copy all programs on side 2 to diskette 2. 

6. Boot Copy n Plus and copy standard DOS to 
side 1. 

7. Change boot program on side 1 to 'Oil Barons 
by Tom Glass'. 

Thats it! Now you have a completely depro- 
tected version. It works perfectly as I have com- 
pleted several versions in the game and at v arious 
lengths. As a bonus you can even list and change 
the program as you hke. 

To Paul R. Wilson (from Computist #69) for 
finishing Aztec: When you have a Irash pile to 
search and it lies directly near or under a stair- 
well, do not search it, as you will may be trapped. 
There might be lit dynamite in the pile, which 
would destroy the stairs. Also, if unavoidable, 
and there is lit dynamite on the screen, leave 
screen as it will follow you to the next screen in 
the same spot and hopefully not near a stairwell. 
Remember: Do not stand on the same level as lit 
dynamite, climb or descend stairs on same screen 
so not to be affected by the blast. 

As to how to light dynamite, you should push 
'G' to crawl and when you notice your arm is 
stretched out push 'P'. Oh yes, remember you 
musthave sticks of dynamite to place it. The best 
score to date for me is 612512 on level 3. 

This works on my disk which is cracked as I 
keep my originals hidden from sight. 

Add the following to the most wanted list: 
Legacy of the Ancients by Electronic Arts, as 
my original disk, which is write protected, per- 
manently crashed and forces a constant reboot 
now. 

Seven Cities of Gold by Electronic Arts, as 
there seem to be so many different versions of the 
game on the market. 

Your new tabloid format is great for typing in 
programs, please keep using this format as you 
also seem to get more for your money. 

© Please I need copies of: 

1 . Newer version of ProDOS user's disk than 
ProDOS 1 .Obasedutilities Apple Computer 1983 
for Apple He. 

2. Newer version of Disk Muncher as my 
copy is version 1.1. 

3. COPY A from the DOS System Master. 

4. 'Wizards Workbench 11' or 'Wizi-Scout' 
or 'Wizi-Doc' by Magicsoft, as Magicsoft no 
longer exists. These are Wizardry scenario aides 
and creators. 

5. Acopyof the program 'HRCG' which is an 
'R' file that is 12 sectors long from the DOS Tool 
Kit disk by Apple Computer. 

©Does anyone have a ma5icr index of past 
issues showing not just title and where to fmd it 
but also an index that would include by company, 
as a lot of companies use repeated schemes of 
copy protection. 

© Does anyone out there have a program to 
print 'Seven Cities of Gold' maps to the printer, 
the original and ones you make yourself. 

My address is: 

Steve Kalynuik 

936 Southdale Road East 

London, Ontario 

Canada 

N6E 1B2 



JAng 



OH 



Readers Data Exchange 



To those of you who are ir, the dark about 
some of the more technical artit ics in Computist 
(or any other computer magazine, for that mat- 
ter): learn. There are two ma ;azines (besides 
Computist) that will help you: 

Warning: the first magazine is for intermedi- 
ate to advanced users. If you just got your Apple 
out of the box and you don't know a bit from a 
byte, then this magazine is not for you and you 
need a little more experience. There are lots of 
books a beginner can get his hands on, just ask 
someone for help. But, if you 're 1 ike me and want 
lo learn by digging into your Apple, both of these 
magazines are great. 

Another Warning: I'm not saying that a be- 
ginner is automaticdly too stupid to tmderstand 
things — on the contrary: I think the best way to 
learn is to dive right in on your own. I just don't 
want people burning crosses on my lawn because 
I told them to subscribe to a $30 magazine that 
they didn'tunderstandorneed. However, if you're 
a beginner and you think you might like either of 
them, go for it! 

The first magazine is called "8/16". As the 
name implies, 8/16 is designed for both 8 bit It's 
or 1 6 bit nGS 's. It is programming -intensive and 
covers areas like Applesoft Basic, ZBasic, Orca, 
APW and Merlin 8/16 machine language. There 
are columns like "OrcaStrations", "The Merlin 
Maniac", and "BASICally Applesoft". Before I 
got a nGS, I thought I was Mr. 6502 with my He. 
Then, upon the recent arrival of my IIGS several 
months ago, I experienced total shock. I felt like 
I was four years behind everybody else — a new 
processor, desktop programming, GS/OS. I 
thought I 'd never be able to catch up. 8/1 6 changed 
that. In just three issues I have learned oodles 
about IIGS animation from an ongoing tutorial 
on the subject. Other recent articles include IIGS 
desktop programming, cursor control, and joys- 
tick hardware modifications. Don' t think it's just 
for the nGS; there's a lot of II stuff in there also. 
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I give my full support to 8/16 (the people who 
publish it are really nice) and I hope you do, too: 

8/16 

c/o Ariel Publishing, Inc. 

P.O. Box 398 

Patemos, WA 98846 

($29.95 per year, also available on disk) 

The second magazine is A2-Central . a pol- 
ished magazine in the Beagle Bros style designed 
with something for everyone: beginner, interme- 
diate, or advanced. The subtitle on every issue of 
A2 -Central is "A journal and exchange of Apple 
n discoveries" — something every user of an 
Apple should be exposed to. If you don't already 
subscribe, I highly recommend it: 

A2-Central 

P.O. Box 11250 

Overland Park, Kansas 66207 

($28 per year, also available on disk) 

Tom Weishaar, A2's publisher, has this motto: 
"The more you learn, the more you understand. 
And the more you understand, the more you 
understand." These words are good advice. A2- 
Central is also a great source of books and periph- 
erals. 

I'd like to digress on two points for a moment. 
One, if you DO subscribe to A2-Ceniral, check 
out the latest issue on page 6.40b-c about 
Broderbund's copy protection policy. It states 
that Broderbund is "currently re-evaluating our 
policies regarding copy protection... times are 
changing and so are our customers... we have 
recently updated [programs] to be hard disk 
compatible." The letter also says that the protec- 
tion of Broderbimd's new entertaiiunent and 
education software will not be "on-disk" and will 
require the customer to "provide some informa- 
tion that can only be obtained from the program 's 
reference material or documentation." 

This means we have won. 

Can you imagine an Apple II software market 
producing great games and application software 
with no copy protection? I can. And it seems as 
if dreams are becoming realities. Software com- 
panies are finally realizing (I'm sure that SOME- 
BODY at Broderbund subscribes to Computist) 
that copy protection is stupid, stupid, stupid. Any 
protection code on disk can be changed! There's 
one more step in the process, though. Once we 
deprotectionists (pronounced "HACKERS") are 
able to demonstrate that we can circumvent 
"manual-check" protection, too, software com- 
panies will realize that ALL protection is dumb. 

The second point concerns Apple II manuals 
in general. The normal price of all of the IIGS 
manuals combined would be over $150. This 
stale of affairs is ridiculous. When I opened the 
box of my IIGS, I saw some manuals that just 
about made me throw up. Lores graphics demos? 
Come on! The so called 'Technical Introduction 
to the IIGS" should have been in its place. It used 
to be in the olden days that you got the technical 
stuff right in the box with your computer. Please, 
Apple, give thosedinky manuals to someone else 
and stop making it difficult for me to learn how 
to program my machine! 

I realize, however, there IS a place for intro- 
ductory manuals. I WANT beginners to learn and 
share the fun of computers. I won't shun you or 
tell you to go home. We're all willing to help each 
other; that's what this magazine stands for. I'm 
certainly not going to pretend that I'm God and 
know everything like some IBM people I know. 

But back to our story.... 

Computist, A2-Central, and 8/16 will teach 
you more about your computer than you ever 
imagined. I find each one to be a great asset. 
Another good source of info is, appropriately 
enough, back issues of SoftaUc. For those of you 
who are new to Appledom, Softalk was one of the 
first major Apple magazines back in the early 
eighties. It's hard to find back issues because the 
publishers went bankrupt. If you h^)p)en to have 
your old Softalk issues, I have found an awesome 
Appleworks database with an entry for every 
article ever published for only $8.00 from: 

Kula Software 

2118 Kula Street 

Honolulu, Hawaii 96817 

(808)595-8131 

The database comes on a double-sided 5.25" 
disk in ADB format. Kula also has databases for 
most other computer magazines like A-I-, Call- 
A.P.P.L.E., Nibble, Softside, A2-Central, and 
many more that I hadn't even heard of. Also 
listed in their catalog are tons of public domain 
programs and books. Great stuff! 

Now I 'm going to shift gears and make a bold 
statement: I have decided not to give away any 
more software (notice I didn't say "krak" or 
"backup"). 

I know all of you hard-core krakers out there 
are probable rolling your eyes and sighing right 
now. Don't get me wrong: there is absolutely 
nothing wrong with hacking or kraking. Explor- 
ing someone else's program is your right and 
your duty. There is also nothing wrong in remov- 
ing copy protection from a disk in order to ac- 
complish this (or for merely backing-up your 
program). But there is the final, crucial step in 
this process that is messing-up the system: giving 
it away. 

The existence of a computer is dependent 
upon many things, the most important of which 
is software. I like the idea of supporting compa- 
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nies like Taito and Broderbund who develop 
great games for the IIGS (even though they DO 
use protection). Software prices are lower now 
than they have ever been before (don't laugh! ). In 
the beginning, most software was around $39.95, 
$49.95, etc. Now, if you look down the columns 
of software advertiser's ads, you see things like 
$24, $24, and $32. 

It used to be that software companies would 
say, "O.K., guys. You really shouldn't copy our 
software." And they would continue producing 
games in the hope that it would stop. Now the 
attitude is, "All right, fine. We'll stop making II 
software and convert everything for the IBM." 

One such company is Sierra. I personally 
think that Sierra puts out some great stuff. It's 
ironic that they are abandoning their Apple line 
of products (see April 1990 Nibble, page 2a). 
Sierra actually got me started with computers. I 
can still remember the day I came home from 
grade school in 1982 and my father was hooking 
our new Apple 11+ to our television. The first 
thing I ever saw on a computer screen was ten 
crudely drawn dead people from Ken and Roberta 
William's "Mystery House". I've been twisted 
and demented enough to like computers ever 
since. 

So let's ban together and stop this! If you 
REALLY think about it, the people who will 
ultimately determine the future of the Apple 11 
are ourselves. We, the 6000people who care, will 
have to decide whether we support software or 
we want to kill our computers. If we sup>port 
software companies, software will continue. If 
we blatantly distribute stuff like mad^ the demise 
of the Apple II will become a self-fulfilling 
prophecy. 

I would personally like to see 6000 letters 
dumped on Ken William's desk. Write a letter 
right now to Ken Williams at: 

Sierra On-Line 
P.O. Box 485 
Coarsegold, CA 93614 

and tell him how you feel about the Apple 11 
(I think the Nibble article got the address wrong). 
Money talks. I think he'll listen to $24 * 6000. 

One thing I DO encourage is the support of 
shareware. A great source of some shareware 
games for the IIGS is: 

Pangea Software 

709 West 21st #203 

Austin, TX 78705 

(512) 474-6616 (answering machine) 

The same people at Pangea made Xenocide 
by Micro Revelations. Pangea has several items, 
but the two IIGS games I personally have are 
Oribizone and Senseless Violence (see May 1 990 
inCider/A+,page 32c). Both haveexcellent soimd 
and graphics. Orbizone is a well done version of 
Asteroids, and Senseless Violence is a hilarious 
spoof of Frogger. Be warned, however, that 
Senseless Violence is not for people who are 
easily offended or for members of the Moral 
Majority. Both are only $5 each, but you have to 
send them your own blank 3.5" disk and return 
postage because they are a small-time operation 
and don' t have a software or tax "license". I know 
I make them sound like a "Miracle Elixer/Snake 
Oil" operation that folds up in a tent and rides on 
the wind, but they really are honest. I even sent 
them cash and they came through! What better 
way to support software than by supporting share- 
ware! 

©Don Lancaster, where are you? Please 
write in! 

Now if you'll excuse me, I have to give my 
valedictory address at my high school gradu- 
ation. It's a possibility that I got suspended for a 
senior praiik, but I'll have to go and see. I'm not 
going to sign this article with some stupid pseudo- 
nym like "Oxy Moron" or "O. Nan Ism". Just 
sign me — JAng 



Au ^ie Genz 
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Softkey for... 

Where in Europe is Carmen Sandiego 

Where in USA is Carmen Sandiego 

Broderbund 

Requirements: 
Super lOB 1.5 
FAST.CON 
Some disks 

This Softkey is crude because it is my first 
one. It may have some things that are not re- 
quired, but it worked forme.This is Broderbund's 
ProDOS version of USA & Europe. I stupidly 
said to a teacher that I would do it, not knowing 
what I got myself into. This was over a year ago 
when I first subscribed to Computist. But with 4 
issues left I finally got it. So hang in there and 
keep trying. When I would boot a bit copy it 
would hang, so I tried to catalog hoping to copy 
the file off on to a disk that would not hang on 
track $00. For where in the USA, the protection 
is only on side A. Sides B & C are normal. The 
same is true for Europ>e. Side A is protected and 
side B is normal. 

Step-by-step 

1. Put SuperlOB into memory. 
LOAD SUPERIOB 
EXEC FAST.CON 
POKE 47498,0 



POKE 47503,14 
POKE 47406,0 
POKE 47411,106 
POKE 47426,24 
RUN 

2. Copy side A. 

3. Format a 5.25" disk with ProDOS. 

4. Copy ProDOS from your System Disk to the 
formatted disk. 

5. Copy all the files except ProDOS from the 
copy just made to the disk with the ProDOS 
disk. 

6. Copy sides B & C (there is no side C for 
Europe) with any disk copier. 

Have fim! 



Michael Patemo 



CT 



Softkey for.. 



Spelling Press 
MECC 



1 . Use COPYA to copy the disk. 
RUN COPYA 

POKE 47397,24 
POKE 47398,96 
70 

2. Sector edit the copy. 

li Ssl Eiila Exam la 

11 08 C2 90 034CXXXX6018EAEAEAEA 
15 03 97 97 DE 

15 OB 97 97 DE 

4. Format a blank disk in ProDOS and copy 
ProDOS from another disk. 

5. Copy the file Mecc.System to the formatted 
disk. Copy all the rest of the files except 
"ProDOS and Z" to the new disk, and Voila 
you have it. 

Softkey for... 

Mercury 

MECC 

A nice word processor from MECC with 
graphic importing capability. 

1. Copy Mercury with Copy n or some other 
copy program that doesn't care about the pro- 
tection. 

2. Make the following edits: 

Blk Byte From To 

00B4 180 18 60 38 60 18 6018 60 

3. Run the new disk to make it write back to the 
disk. That's it. 

I thank the gentleman in Computist #67 for the 
help in cracking Spelling.Press. Although it 
was not exactly the same, he gave enough 
information for me to complete the job. 

CPR A^ent Canada 

Well, here it is — my first letter and my first 
contribution to Computist. Before I start explain- 
ing my softkeys, I would like to extend a very 
sincere word of appreciation to the grand old 
masters of this magazine/tabloid (Edward Teach, 
Brian Troha, Bill Jetzer, Bob Igo, Jack Nissel, 
Gerald Myers, and all the others who gave so 
liberally of their time and talents for the benefit 
of those of us who so often "just didn't get it"!). 
Eighteen months ago I booted my first computer. 
Now, thanks to this publication and those who 
took the time to contribute, I am beginning to 
understand something about programming and 
the operation of computers in general. I'm ex- 
tremely appreciative and am determined to "pass 
it on" by doing my part to help others. (Two of my 
colleagues have sent in orders for a subscription 
after I showed them the goldmine of informa- 
tion.) 

Please continue to send in softkeys with thor- 
ough explanations. Those who don't need or 
want details can always skip over them. How- 
ever, those long explanations are responsible for 
my being able to contribute now. Believe me 
when I say that they are important to those of us 
who have a desire to really understand what is 
going on. 

Please keep this publication alive. It so out- 
ranks the competition that there is no competi- 
tion! 

And finally, thank you Charles Haight and 
Karen Fitzpatrick for the COMPUTIST. It has 
literally breathed life into my ability to use this 
incredible machine. 

Softkey for... 

Math Masters: Addition & Subtraction 
DLM 

Requirements: 

Fast copier (I used COPY DISK on COPY H 

PLUS) 
Sector editor 

The disk is ProDOS and catalogs easily using 
Copy II Plus. I noticed that the system file that 
normally follows immediately after the ProDOS 
file was the last file in the catalog. Suspicion #1 ! 
I went straight to a fast copy of the disk which 
copied without so much as aread enor. Suspicion 
#2! I booted the copy. The ProDOS screen came 
up and then I was dropped handily into the 
monitor. I was now almostcertain that the trouble 
was in the system file. I checked the start of the 
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file by using "View Files" on the Copy II Plus 
main menu. I jotted down the A9 00 8D F4 03 A2 
that began the file and then searched the disk for 
it. The file started at Track $20 Sector $00. 

I began a quick disassembly and noticed that 
about half way through the sector there was a 
substantial break in the program. Suspicion #3 ! I 
went back to the beginning of the sector and 
began perusing with a httle more care. This time 
it looked and smelled like a signature check. I 
jotted down all the JSR's and JMP's as a matter 
of habit and thought I would try my luck with 
these first. 

ThefirstJSR (20 0021)thatINOPed changed 
nothing. So I restored it to its proper place and 
went to the first JMP (which was two bytes later 
after a BCC - 90 03). This turned out to be the 
jackpot! Replacing the 6C F2 03 with EA E A EA 
completely disabled the check and the program 
carried on as though the check never existed - 
which is exactly the way it ought to be. 

I checked the Teacher Disk (Disk 2 in the 
package) and found it to be unprotected and 
entirely copyable. Now, go ahead and make that 
back-up and turn those school kids loose on 
another very excellent program from DLM! 

Step-by-step 

1 . Fast copy the disk. 

2. Sector edit 

Ids Sfil B^ From la 

$20 $00 2C-2E 6CF2 03 EAEAEA 

Or search for 20 00 21 90 03 6C F2 03 20 00 
BF. 

Softkey for... 

Cross Country Canada 
Didateeh 

Requirements: 

Fast copier (I used COPY DISK on COPY E 

PLUS) 
Sector editor 

It seemed to be a fairly normal DOS disk — 
it catalogued, displayed the Applesoft BASIC 
prompt "]" when booting, etc. So I tried fast 
copying the disk. There was an error on Track 
$02. 1 then checked Track $02 with a sector editor 
and found only two sectors in use, sectors $00 
and $07. Sector $07 looked out of place — it 
looked like part of the DOS routine. Sure enough 
there was an exact duplicate at track $01, sector 
$07! I took a chance and blanked out the "extra" 
on track $02. 1 then booted the disk. No deal! It 
died to BASIC in the middle of the first graphic 
—THE MIDDLE OFTHE FIRST GRAPHIC! !? 

I went back to the catalogue. There seemed to 
be three potentially troublesome files — a file 
called "NEWS", another called "DEMO" and a 
third called "COPYRIGHT 1986". My reason- 
ing no w was that I would simply delete these files 
one at a time, boot the disk, and check to see if we 
lost a file with a graphic in it somewhere. I started 
with "NEWS" because it was the only BASIC 
file and lots of programs start that way. But not 
this time. I "undeleted" it again and went to the 
"DEMO" file. Same deal. So I then went to the 
"COPYRIGHT 1986" file. I noticed in the proc- 
ess that it was five sectors long! Pretty long 
copyright notice! I deleted it and booted the disk. 
BINGO! Up came the "HLE NOT FOUND" 
message. Next I went to the disk map and found 
that the copyright file was on track $13 living in 
sectors $OF-OB. I then disassembled sector $0E 
(sector $0F simply pointed to $0E). Sector $0E 
was filled with a lot of "question marks" (I hate 
those! ) with the odd CMP. Then I noticed a JMP 
to $8A70 of all places! I took a chance and EAed 
the jump. When I booted the disk, up came the 
graphic, the Canadian flag started waving, and 
there in the comer was the copyright notice! 

Step-by-step 

1. Fast copy the disk. 

2. Sector edit. 

Iris Sd Eiiia Eism I2 

$13 $0E $4345 6C708A EAEAEA 

Or search for 8D 5E 46 6C 70 8A 30 8A 76. 

Softkey for... 

Mark Manager v6.6 
B£. Software 

Requirements: 

A slave disk with HELLO deleted 
DEMUFHN PLUS 

1. Boot the Mark Manager Program disk. 

2. When the disk drive stops and the main menu 
is displayed, type "Q" at the prompt. (This tells 
the program that you wish to "Quit".) 

3. Wait for about 2 full minutes until the BASIC 
prompt 0) and a cursor appears on the screert. 

4. Type "FP" to clear all the "flags" in memory. 
FP 

5. Get into the monitor and move the RWTS to a 
safe place. 

CALL -151 
6000<B800.BFFFM 

6. Insert the slave disk (with no HELLO) and 
boot it. 

C600G for flat 6 disk 

7. Load but DO NOT run DeMuffin Plus. 
BLOAD DEMUFFIN PLUS 
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8. Go back into the monitor and move the Mark 
Manager RWTS to where DeMuffin Plus can 
frnd and use it. 

CALL -151 
B800<6000.67FFM 

9. Alter DOS so that it can read the disk. 
B925:18 60 

B988:18 60 
BE48:18 

10. Start DeMuffin Plus and choose "Convert 
Files". 

803G 

11. When asked for the filename, type the wild- 
card equals sign "=". 

12. When asked if you want to be prompted, 
answer "N". 

13. Copy all the files from the Mark Manager 
disk to your slave disk. 

14. Load each of die files excluding the "SN" file 
and delete each "CALL 47721" and "CALL 
47741". Then SAVE the file back to disk. If 
the CALL falls within a program line, simply 
re-type the line and leave the CALL out. Here 
is some extra help: 

FiIeMH4 delete lines 91 and 93 

re- type line 10165 
File MF4 delete line 100 

retype line 51015 
File MM4 delete line 1 17 

retype line 52035 
File MR4 delete line 1 14 

retype line 52010 
File MB4 delete line 100 

retype line 52010 

Don't forget to save each of the above files 
back to disk after the changes. 

1 5. Use Copy II Plus or a similar utility to change 
the boot file to MH4. 

You now have a completely COPYA-able 
and totally functional grading program! 

Extra Help 

1. Speed the program up by adding a fast DOS. 

2. Once you have learned the program, sj)eed it 
up even more by deleting lines 20010 to 3 1 020 
in file MH4. All of the files and procedures of 
the jjrogram must be accessed through the 
MH4 file. This file also contains the tutorial 
for the program - in other words, miles of text! 
By deleting the above lines, this file is reduced 
to about one third its original length, which 
calculates out to a much faster program. 

3. The "SN" file is the "registration" text file. 
When you purchase the program it is regis- 
tered to the purchaser. Each time you print 
reports, tliis registrafipn gets printed at the top 
of the page. Now we can change this text file 
to print whatever we want at the top of the 
page! 

4. Since the entire program is written in Apple- 
soft BASIC, modifications are easy and excit- 
ing! Try rewriting the info that pops up with 
the Main Menu. There are some interesting 
possibilities here! 

Oh, by the way, don't forget to use the Back- 
up module. There is nothing worse than having 
all your marks go down the tubes because you 
accidentally set your disk too close to some 
electro-magnetic source! Nothing is harder to 
explain than "I've lost my Mark Book"! 

Softkey for... 

Spelling Mastery 
DLM 

Requirements: 

Fast copier (I used COPY DISK on COPY H 

PLUS) 
Sector editor 

This one seemed so easy... after I got it! And 
I'm still not absolutely sure what I did. There's a 
great deal of just plain luck that goes with this 
disk cracking business. But it seems to me that 
my "luck" is getting better as my experience 
increases. If the aWlity tocrackprotectionschemes 
depended solely on understanding exactly what 
the program was doing, I would still be working 
on my first disk! 

The protection on this DOS program rests 
completely on a signature check. If you fast copy 
the program and then boot the copy, you will hear 
the program load, then there will be a 2-3 second 
silence (while the check is taking place), and then 
a graphic screen comes up that says you have a 
disk error. This is where the battle actually be- 
gins. I proceeded with the following steps (and 
don't let the simplicity of the explanation delude 
you into forgetting that it represents several hours 
of work): 

1. I checked the contents of the Applesoft 
BASIC Hello file as a matter of habit. It was 
short, loaded one binary file and ran another - 
both files were listed right after the Hello file in 
the catalogue. 

2. Since the graphic had text in it and since the 
drive shut off as the graphic came up, I knew the 
text and C088 must be somewhere on the disk. I 
searched for the text. I found it at track SI 3, sector 
SOF. I fired a few shots into the dark (changed a 
few bytes with my sec tor editor) and observed the 
sparse results. It became appeirent that I was 
working with the symptom and not the problem. 
No matter what I did to try to bypass or disable 
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this graphic (and its message) so that the p'ogram 
would continue to run, it wouldn't work. It oc- 
curred to me that by the time the graphic and 
message appeared, the signature check must al- 
ready have taken place somewhere else. This 
graphic was just the result of the check. I needed 
to back-track. 

3. 1 went to Copy 11 Plus' Disk Map utility on 
their main menu. Here I discovered that the Menu 
file started at track $ 12, sector SOD (right after the 
Hello file at track $12. sector SOF). Again I fired 
a few shots into the dark (changed some bytes) 
and added a few more that I thought were more on 
target. I got big ZERO results. I was getting 
frustrated so I went back to the very beginning of 
the file — sector SOD. I noticed that the first thing 
the file did was JMP to S6000. Out of pure 
maliciousness I NOP'ed the jump and booted the 
disk. 

After the usual loading of the files, the com- 
puter dropped me into the monitor! Well, well, 
well - at least it was different! I decided to check 
memory location S6000 since I was already in the 
neighborhood and see if there was in fact some- 
thing special about it. As it turned out, it didn't 
look that exciting. But I jotted down the first 
several bytes to check their location on the disk. 
I then scanned the disk for these bytes and found 
them at the very beginning of sector SOF of track 
S14 — the start of the file named Start — the very 
same that was BLOADED by the Hello file! 

4. 1 could tell that I was closing in. I began 
perusing these bytes on the disk more carefully 
than I had when I checked them out in memory. 
I did my very very best at pretending I knew what 
the program was doing. I knew that a 60 (RTS) 
marked the end of a routine and I found one of 
those close to the end of the sector. I also checked 
for BNE's and CMP's to see if the signature 
check were at all obvious. It wasn't but there 
were a couple of BNE's. I tried replacing them 
with EA's - it had worked on some others I 
cracked. Not this time, however. I edited them 
back where they belonged. I then went up and 
down the sector several times, tracing, getting 
lost, and trying again. Finally I decided that a 
JMP to $15C0 was out of character. I replaced it 
with EA's and booted the disk. God bless us all, 
it worked! 

5. Working backwards now, it seems incredi- 
bly obvious - in fact, embarrassingly obvious! 
After reading Edward Teach's treatise on signa- 
ture checks more times than I would like to a<£ni t, 
I'm sure he would not be proud of me now! I 
remember telling my high school math teacher 
on one occasion that if he would tell me the 
answer, I would surely be able to figure out the 
problem. He looked at me rather menacingly 
over his glasses and sfneered, "Young man, if we 
knew the answers, we wouldn'thave the bloody 
problems now, would we!" 

Step-by-step 

1. Fast copy the disk (it should copy with no 
errors). 

2. Sector edit. 



$14 



$0F 



SM From 
$D3-D5 4CC015 



l2 
EAEAEA 



Or search for C9 1 FO 05 A2 FF 4C CO 1 5 4C 
91 62 A2 FF. 

Softkey for... 

Elementary Genetics 
MECC 

Requirements: 

DOS 3.3 System Master (or other DOS source) 

initialized disk with "Hello" deleted 

Super lOB 1.5 

MECC controller from Computist #65, p.l9 

Softkey & Fix for the He 

This is an old program but a rather good one 
for teaching and/or reinforcing the basic con- 
cepts of genetics. It came to me via a fellow 
colleague who complained that it would not run 
on the Apple He machines nor the Laser 128 
machines in their school lab. They had a couple 
of older Apple machines that it would work on 
but it was often very inconvenient to free up these 
machines at opportune times. I promised to take 
a look at the program and what follows is an 
overview of my notes while I worked with it. I 
hope it proves useful to other teachers or inter- 
ested persons. 

Details 

This program is a hacker's dream! There are 
two sets of files on this disk - one set that the 
computer runs, and another set that has all the 
REM lines in that explain what is going on and 
how the program does it! What more could you 
ask for? (A little dumb luck perhaps?! That's 
exactly what I needed and got.) 

Removing the protection from this program 
was really nothing. All the credit has to go to Ray 
Darrah and his Super lOB and Jack Nissel with 
his controller in COMPUTIST #65. Once the 
protection was gone, it was easy to get into those 
files. I noticed when I ran the program that it 
stopped very abruptly at the instruction screen. 
The opening graphics and credits had operated 
fine to that point. And since I knew that this 
program ran okay on the Apple 11+ machines, it 
sounded (looked?) like a memory location error. 
I catalogued the disk and scanned through the 



files. I noticed that most of them were Applesoft 
BASIC. I groaned a little at the fact that many 
were fairly long. No one looks forward to scan- 
ning through miles of BASIC, especially when 
you aren't even sure what it is that you are 
looking for. I began testing some of these other 
files by simply RUNning them - more or less to 
observe the behavior of the computer and pro- 
gram. 

When I ran the file called B LOOD INSTRUC- 
TIONS I got a surprise. It ran just fine. Up on the 
screen came the program as though this were the 
disk HELLO! All the other files had yielded 
nothing but errors and nasty error messages. I 
was instantly inquisitive as to why this file ran 
perfectly and none of the others. So I dropped 
back into BASIC with a Ctrl reset and asked for 
a LIST. To my surprise, the LIST yielded a new 
set of credits arid credentials for this part of the 
program than for the first part. In other words, 
this seemed to be one of those "modular" jobs 
where differentprogrammers write differentparts 
of the program and then it is all patched together 
to run. 

But the best part was that I could immediately 
see that this file was having no trouble placing a 
special graphic style script on the screen that the 
real HELLO file on the disk was stumbling over. 
I began scrolling through the first few lines of the 
file. It was no time at all before I recognized two 
lines that were almost identical to lines at the 
beginning of the HIRES CHARACTER PLOT 
section of the HELLO file. (Those REM lines 
were absolutely invaluable - Thank you so much 
MECC!) 

After spending a few minutes comparing, I 
was certain that I could simply replace the lines 
:in the HELLO file with the two similar lines from 
theBLOODINSTRUCTIONfile.Itriedit, booted 
the disk, and away it went. I was elated. I didn't 
even care that the disk died again a few minutes 
later. I went back to the CATALOG and began 
checking through the files (LOADing and UST- 
ing them one at a time) for similar routines. It was 
when I came across a place where one file had 
combined the two lines into a single line (and I 
was groaning over the typing job since I don't 
have a line editor) that it occurred to me that the 
only real difference was the CALL. I tried chang- 
ing only the CALL 22016 to CALL 22019 and it 
worked fine. 

I sent the program back to my colleague with 
an instruction to try it on all his machines with his 
fingers crossed. He called back with a big smile. 
Now the genetics students can work on any 
computer in the lab and they have one less excuse 
fornothaving the theirBiology homework done! 

Step-by-step 

1 . Boot the program. 

2. At the Applesoft prompt (]) reset into monitor. 

3. Move the RWTS to a safe place. 
1900<B800.BFFFM 

4. Boot the slave disk. 
C600G 

5. Atthe"nLENOTFOUND" message, remove 
the slave disk, insert your SUPER lOB pro- 
gram and: 

BSAVE RWTS.MECC, A$1900, L$800 

6. RUN your SUPER lOB program. 
RUN SUPER lOB 

7. Follow the prompts' and at the appropriate time 
type in the controller or EXEC it, whichever 
method you prefer. 

8. Again, at the appropriate time, insert your 
original in Drive 1 and your initialized disk m 
Drive 2. 

9. Copy the disk and put your original away. 

10. Use your System Master to load DOS into 
your computer. 

1 1 . Insert the copy of the program. 
LOAD HELLO 

12. List line lOlOandchange the CALL 2201 6 to 
CALL 22019 by retyping the line or using a 



line editor. 

13. Save the changes back to disk. 
SAVE HELLO 

14. Do exactly the same thing to the following 
files and in the following lines: 

CHROMY BUG INSTRUCTIONS — line 13 
CHROMYBUG — line4 
CHROMY READ — line 13 

Remember to save the files back to disk each 
time. (If they are locked, you will have to unlock 
them, of course before saving them back to disk. 
Be sure to lock them again afterward.) 

Softkey for... 

Alligator Alley 
DLM 
Requirements: 

Initialized disk with "HELLO" deleted 

Super lOB 1.5 

Swap controller 

A way into the monitor 

This program looked easy so I took several 
short cuts and ended up regretting it. I could see 
with a nibble editor that the epilogues had been 
adjusted so I quickly tried using COPYA (with 
the B988:18 60 , B925:18 60 , BE48:18 modifi- 
cations). All went off quite well - the drive 



growled through Track $03 but I simply assumed 
it was an empty unformatted track. "The resulting 
copy ran fine - except for two glitehes. The 
second and third logo graphics came up on the 
screen partially skewed and partially scrambled. 
The program itself, however, ran fine. I wasn't 
satisfied. Moreover, the catalogue track (Track 
$11) appeared to be written in some Bangkok 
dialect and that bothered me as well. A good rule 
of disk cracking is to make as few changes as 
possible to get the functional COPYA-able disk. 
I now had that. But being who I am, I set out for 
the PERFECTLY functional and COPYA-able 
disk. 

I first used my sector editor (Copy n Plus) to 
quickly peek through the tracks. I was a bit 
surprized to find Track $03 had a couple of 
sectors in use (that was the track that caused the 
32 grinding recalibrations). Then I was further 
surprised to find all the tracks between Track $03 
and Track S 1 1 empty ! Furthermore, Tracks $20- 
$22 were not that full either. 

Assuming (incorrectly!) that a byte or two 
somewhere along the line was being misread in 
the copy process, I decided to try another angle. 
I set Copy II Plus to "MANUAL SECTOR 
COPY", told it to ignore epilogues, and set it in 
motion. It read the DOS tracks fine but told me it 
was getting read errors on all the other tracks. I 
had seen the strange sync configuration under the 
nibble editor, but since those tracks were all 
empty anyway, I didn' t care. When I still got read 
errors on Trarcks Sll-$22, 1 decided to let it go 
and take my chances. When I booted the resulting 
copy, it ran without a hitoh! Good graphics, fast . 
loading, everything! But this STILL wasn't 
COPYA-able. 

Out of curiosity I booted Bag of Tricks 11 and 
checked the epilogues on this new "sector cop- 
ied" copy. Instantly Bag of Tricks "honked" a 
warning - but not an epilogue warning. It was a 
track warning. The track number was not correct. 
I scaimed through the disk. Sure enough, every 
track was numbered incorrectly. The pieces were 
now beginning to fall into place. But Track $11 
was still a foreign language. The best way to 
decode it seemed to be with its own RWTS. I 
booted the sector copy, interrupted the loading, 
went into monitor, moved the RWTS to $6000, 
Bloaded FID, moved the RWTS back to $B800, 
and catalogued the disk. This, I decided would 
tell me immediately if this process would work. 
Up came the files - in English! Since I was this 
far, why not just FID the files to a new disk? I 
tried. It didn't work. I wasn't surprised. 

Next I went to Super lOB. Using the same 
process as above, I captured the RWTS and saved 
it to disk. Super JOB and the SWAP controller 
then "swapped" the files just fine - all in English, 
all catalogable, all perfectly functional. The 
embarrassment? It was, not realizing from the 
onset that Super lOB was the way to go. Just to be 
sure, I tried using Super lOB and the SWAP 
controller on the original disk (after capturing the 
RWTS from the original, of course). It ran dis- 
gustingly perfect. Now we have a disk with a 
proper catalogue (in English ! ), good graphics (no 
skews or scrambles), and correct track numbers. 
By the way, it was worth it. DLM makes 
excellent programs for school kids! 

Step-by-step 

1 . Boot the original and reset into the monitor at 
the "]". 
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2. Move the RWTS to a safe place. 
1900<B800.BFFFM 

3. Boot the slave disk (with no "HELLO"). 
C600G 

4. Remove the slave disk and insert your Super 
lOB disk. 

5. BSAVE the RWTS to be used later with the 
SWAP controller: 

BSAVE RWTS.DLM, A$1900, L$800 

6. RUN your Super lOB program. 
RUN SUPER lOB 

7. At the prompt, EXEC the SWAP controller. 
EXEC SWAP.CON 

8. LIST line 10010 and edit it to say: 
RWTS.DLM,A$1 900,L$800 

9. RUN the program and follow the prompts. 

You now have aperfectly COPYA-able Alli- 
gator Alley. 

Softkey for... 

Halley Project 

Alert & Tom Snyder 

Requirements: 
COPYA 
Sector Editor 

Thanks to Jim Bancroft in COMPUTIST #61 
in his notes on MindscajDe for the initial lead in 
the cracking of this program (i.e. the 4C 00 C6). 
I have no idea what a Forth system is that he 
mentions nor did the 4C 00 C6 occur in track SOO, 
sector S03 as his did. But I thought I would search 
the entire disk anyway just in case. When it 
turned up in track Sill was immediately suspi- 
cious. Why would there ever be a boot routine on 
track SI 1 of any disk? I then tried Jim's sugges- 
tionof placing OO's in the D086 that immediately 
preceded the JMP. (It looked like DO 86 4C 00 C6 
on my disk.) I changed it to DO 00 as Jim 
suggests. It seemed to make no difference to the 
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death of my program. I then tried changing the 
IX) 00 to EA EA. Again, there seemed to be no 
difference at all. I then changed it back to DO 86 
and changed the 4C 00 C6 to EA EA EA. This 
time when I booted the disk, I was bumped into 
the monitor. Now, at least I knew for sure I was 
working in the right spot, or at least in the right 
ball park. 

I went back and edited the 4C 00 C6 back 
where it was and started examining the code just 
before it. I noticed a very similar read and check 
routine a few bytes prior to the one I had been 
altering. Obviously the program was clearing 
that one okay - and it ended with a 4C 00 1 D. I did 
the unthinkable - 1 changed the 4C 00 C6 to send 
the program back through the door it had just 
come out of, the 4C 00 ID! When I booted the 
disk, there was a moment's hesitation (while the 
computer muttered "What fool is at the helm?") 
and then up came the credits and on went the 
program. Thanks again to Jim Bancroft and 
humble pardons to Edward Teach, Jack Nissel, 
Brian Troha, Bill Jetzer, and all the others who 
are at this moment clutching their heads in ag- 



ony! 



Step-by-step 



1. Copy the program using COPYA and the 
following modifications: 

B983:18 60 
B925:18 60 
BE48:18 

2. Sector edit track Si 1, sector $00 by searching 
for 4C 00 C6 (if it is not found in this sector, 

• search the entire disk) and then changing it to 
match the IMP that occurs immediately before 
it (in my case it was 4C 00 ID) 

Softkey for... 

Magic Slate (20/40/80 column) 
Sunburst 

Since my Magic Slate disks seem to be differ- 
ent from any of those discussed in previous issues 
of COMPUnST, I offer the following "cracks" 
hoping they may prove useful. 

20/40 COLUMN 

1 . Fast copy the disk using a fast copier that will 
elicit the message "Unable to Load Magic 
Slate" when the disk is booted. Not all fast 
copiers will copy this program properly. (My 
Copy n Plus failed this time, but my Disk 
Muncher did the job easily - 1 was surprised!) 

2. Search for 90 03 4C 30 22 AO 00 and edit the 
4C 30 22 to EA EA EA. There should be two 
4C 30 22's. The second occurs in the sequence 
DO F7 4C 30 22 20. Again, substitute EA EA 
EA for the 4C 30 22. On my program these 
JMP's were on Track $00 in Sector $01 - the 
first coming at bytes 3D 3E 3F and the second 
at bytes 5E 5F 60. Be sure to write the changes 
back to disk. 

80 COLUMN 

1 . Again, use a fast copier that copies such that 
the message "Unable to Load Magic Slate" is 
screened when the copy is booted. See above. 

2. Search for two occurrences of 4C DB 21. On 
my disk they were on Track $00 in Sector $01 
- the first at bytes 40 41 42 and the second at 
bytes 61 62 63 . The first came in the sequence 
90 03 4C DB 21 AO 00 and the second in the 
sequence DO F7 4C DB 21 A5 FA. (Notice the 
similarity to the 20/40 colimin program.) Once 
you have located the sequence, replace the 4C 
DB 21' s with EA EA EA. \yrite it back to disk 
and you're finished. 

Extra Help 

The changes required for my jwogram were 
altogether different from those in Computist #68 
but the location was the same. If your bytes don't 
match, look for two identical jumps (JMP's) 
about 30 bytes apart. If there aren't any jumps, 
look for JSR's. Try several combinations. Be 
patient and persevere! 



Jeff Tramel 
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Playing Tip for... 

Bard's Tale III 



The inquiries about Bard's Tale III have been 
bugging me, so I'll reveal everything you wished 
to know. 

To get the Nighispear out of the tower in 
Arboria: You must get some Water of Life in the 
Crystal palace and put it in a wineskin or some- 
thing, then obtain an acom. Go to the top of the 
tower, place the acom in the hole and water it 
with the Water of Life. This opens the barrier to 
let you find the Nightspear. 

To get the Rainbow Rose in Lucencia: You 
must kill the Rainbow Dragon and collect his 
blood as you did with the Water of Life, then poor 
the blood on the empty bush, and answer Arturo 
V. Magidin, who's questions were pretty general 
if he Knew the answers. 

To succeed in Getidia: Go to the tower in the 
Northwest comer where the monster is and cast 
INWO, WIHE, and FOFO — get the lens. Go to 
the tower in the Northeast comer and cast LEVI, 
ANMA, and PHDO — get that lens. Go to the 
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tower in the Southeast comer and MAFL,SHSP, $14 $04 $14-16 8D45 08 EAEAEA 
FEAR, SUEL, and SPBI — get the last lens. $14 $04 $40-42 8D4508 EAEAEA 
Place the proper lenses in the proper shrine posi- 
tions and the shrine opens. Go down, find Lanatir Advanced Playing Technique for... 
(he will be dead, but it doesn't matter) then go Bandits 
through the door near his coffin. The items are , 
there. 

To succeed in Tenebrosia: Get the Shadow On Bandits, yet another method of finding the 

Lock in the canyon, then collect some tar from right edit had to be used. You are given 04 ships 

the middle of the tar pit in the same way as the The at the beginning of the game. However, when the 

Water of Life and the blood. Go to the forest, display number goes to 00, the game continues 

Look around until you can see a hole behind with your last ship. So, I realized that I must look 

some trees . Use the tar to bum the trees down and for 05 because after five times getting blown up, 

get the Shadow door. Now go to the middle of *e game ends. There are also cases when one 

Nowhere place the door down then put the lock must search for one less than the obvious number 

on it. This permits entry. Go to the 2nd dungeon instead of one more than the obvious number, 

level and go to the farthest north wall. In the Note: enter the same number for both edits, 
center square the wall is fake, go north through it 

and Sceadu is behind the door. N urn ber of Ships 

For Tarmitia: (Which was the most difficult -^ Cgt gy|g p^gni To 

for me although it's pretty simple once you know $0F $0D $43 05 any 

how.) Go to the Death's Head in Troy and say $21 $0F $4A 05 any 
ARES. Rome is MARS. Hiroshima is SUSA- 

NO-O. Stalingrad is SVARAZIC. Nottingham is Advanced Playing Technique for... 

ST. GEORGE. Wasteland is SDIABM. Berlin is Prince of Persia 
TYR then WERRA. Do the first step then you'll 
know what the others are for. If there are any 

more questions concerning BT3 let me know On Prince of Persia, a masterpiece of a game 

through the magazine. I don't know if anyone which you simply MUST play, I did not desire to 

noticed but there's a gross hi-res picture on my poke around in memory if I didn't have to, so I 

boot disk of BT3 called YUMMY. simply decided to edit things on the saved game. 

©As mentioned many times before, new ^ fo™^ »"' ^here the saved game was being 

buyers of Apple computers don't get any of the stored by making anothercopy of thegame.Ihad 

programs mentioned in this magazine. Just a one game saved on level 3 and then saved one on 

short time back the only computer magazine I l^^^l 4. 1 compared the disks with Locksmith 6.0 

was getting was mosUj^ advertising and boring ^^^ compare. That told me that the copies dif- 

colunins.ThenIstartedgettingComputist,itwas fe""*^ °"ly «" "^ack S17. sector $00 of disk 2. 

a shock to my system. I didn't understand any- Next, I used a utility which I wrote that compares 

thing that was being said. I slowly got the hang of individual sectors to tell what bytes differ. Then, 

it with Copy H plus, but I need some programs ^ compared the two and made a bunch of edits, 

that are used here. *"*^ by trial and error (mostly error) I foimd out a 

Idon'tknowwhetherthisispiracyornot,but bunch of mteresting information. 
I would like to have a copy of the DOS 3.3 (gjjg 2): Saved level 
System Master disk, ProDOS Users disk. Lock- 
smith or it's equal, and an assembler of some M S£l &C3l EsSUR IQ 
kind. Ifyou could send me these or tell me where ^l'' ^ ^ '' ^'^^ 
to get ihem. I seriously doubt there's a users (side 2): Hits 
group here and no one I know uses an Apple. 

With 4,000 readers out there I hope there's some li Sc! Bld£ From l2 

who will help me. Send to: $17 $00 .$01 ?? 11 (MAXIMUM) 

P.O. Box 443 (side 2): Maximum time (60 minutes) 

Moxee, WA 98936 t. c. d. c t 

Iijs Ssl Eyl£ From la 

If you would like the disks back please tell $1 7 $00 $04 ?? 00 

™®' Note: The above information on Prince of 

Persia with "??" is so marked because the values 

Bob Ig O PA there will depend on the saved game itself. 

I figured out how to edit some of the games I 

was previously unable to edit by modifying the Advanced Playing Technique for... 

approach I was using. For example, in the case of Borg 

double hi-res games, the edit information may » 
even be stored in an auxiliary location, making it 

rather difficult to find. Number of Lives 

This information is stored at $23CB. I can't 

Advanced Playmg Technique for.. . ^^^^ ^ ^^-^^^ ^^-^ ^^^^^ ^^^^^ ^^^ ^^^^ ^^ 

Heavy Barrel crack the game and therefore many places the 

? right edit could reside. 

I had to make several sector edits just to find 

the right one for Heavy Barrel. It turned out that Advanced Playing Technique for... 

the storing location seems to be in ROM, but it's Battletecll 

actually in auxiliary RAM. 9 

Extended lives t. ^ » u 1 , • 

The Crescent Hawli's inception 

$?3 § If ^ m ^^Note:Thefollo.ing edits arefor saved game 

Advanced Playing Technique for... .,f^f"^- ""^K^}^' f=f ^^' ''^f ^^^^ 

FI nRVNOin will give you 65,535 cash when you replace them 

rLUBXlxuiu withFF's. Don't worry about where to edit for 

•" more; just invest in B AKPHAR stock and you'll 

have credits coming out your ears. 

" Skills: For Jason, the skills are on Track $ 1 6, 

M Ssl E^ ElQlll' la Sector $09. 

$0E $02 $D9-DBCEA0 0B EAEAEA ^ ■ byte Skill level Hex 

In the case ofFL0BYN0ID,asup6rior French Bowand Blade $10 Unskilled $00 

version of Arkanoid, I had to put my encoding Pistol $1 1 Amateur $01 

skills to the test. The number ofpaddles, $09, was Rifle $12 Adequate $02 

being stored as $B9 for SOMEreason. Of course. Gunnery $13 Good $03 

the French were never notorious for their logic Piloting $14 Excellent $04 

when it comes to numbers; 99 sounds like 4, 20, Tech $1 5 

10, 9 in French. Medical $16 

The hex code for a decimal 9 is $B9 (hi (ie. A hex value of $04 at byte location $10 

bit set) RDEXed means that you have excellent skill with Bow and 

Blade.) Now, if you really, really want to, you 

Advanced Playing Technique for... can give Jason all "Excellent" skills by editing 

DinoEggS bytes $10-$16 to all S04's. 

9 For those of you who have had trouble iden- 

^ ,. ^. , „^ tifying those 'MECH parts, here's some useful 

ToMrTiradtlstiUcantfmda lives APT information.(Right=yourright,notthe'Mech's) 
for Dmo Eggs, but 1 came up with the next best 

thing plus a little extra. Es" Location 

intercooler where the mouth of the 

Maximum number of Eggs carried 'MECH would be 

Note: the number entered as 'any ' must be the lorso mainframe .. top right of body 

same in all four edits. elbow actuator ....between shoulder and forearm 

m S£! Bm Ersm I2 gyro housing next to the top of the right leg 

$13 $08 $9B 03 any jumpjet intake ....The top bit of the left leg 

$14 $05 $76 03 any foot unit the left foot 

$1A $06 $BE 03 any leg main thethinnerpartoftherightleg 

$1A $06 $EC 03 any above the calf 

^ ... . foot actuator the part of the right leg just 

Contamination immunity ^^^^ ^^ ^-^^^ ^^^ 

li Ssl B^ Emm la foot casting the right foot 

$14 $04 $93-94 E9 01 EAEA If there's anyone out there who would like to 
$99 FO DO 

*3a ru uu • request an APT, contact me through the maga- 

Readers Data Exchange 



zine or a back issue address. I enjoy a challenge, 
and I thank J.P. Tirad for providing one. 



The Snake 



OH 



I have a solution to the "tabloid paper is too 
flimsy" problem. I merely cover each tabloid 
issue with clear contact paper purchased from my 
local dimestore. The issues are a lot easier to 
handle that way. 

Kind ofexpensive and you would have to 
be awful careful putting the contact paper 
on RDEXed 

A Reader Review of ... 

Prince of Persia 



Apple He users rejoice! (Apple Il-t- users 
yawn.) Prince of Persia is awesome! Many lie 
users nowadays complain about the lack of new 
He-specific games on the market. Prince of Per- 
sia is a fabulous double-hires game from Broder- 
bund that was specifically designed for the He. 
The reviews I've seen of P.O.P. in many com- 
puter magazines don't do it justice: the graphics, 
animation and sound are top-notch! In addition, 
its $25 pricetag from most mail-order houses is 
almost a steal compared to other games out there 
(S39.95, $49.95, etc.). Ifyou have an Apple He 
with a color monitor, get this game! (sorry Il-t- 
users, you need 128K.) Although P.O.P. is heav- 
ily protected (and I don' t have a krack for it), I'm 
sure a krack will be available from someone by 
the time you read this. 

Softkey for... 

Milliken Math Series (revisited) 



Requirements: 

DOS 3.3 disk 

I was asked to krack the Milliken Math Series 
by one of my teachers because disks around here 
are treated like luggage in Samsonite commer- 
cials. Upon reviewing the method in issue #57, 
page 26b, I noticed I had to use the ancient 
Demuffin (yyecch!). I then turned to #68, page 
9a, and used the method there. I booted my copy 
but subsequently "crashed and burned" into the 
monitor. I finally copied the disk using my softkey, 
so I decided to share it with everyone (besides, 
my version wasn't the one in #57, and the sector 
edits in #68 weren't explained). 

Step-by-step 

1 . Initialize a DOS 3.3 disk with a hello program 
of "BOOT". 

INIT BOOT 

No/e.-Noiicel said "DOS 3.3". The reasonmy 
copy kept crashing was that Milliken disks didn't 
like ProntoDOS. The kracked copy worked fine 
with DOS 3.3, but ProntoDOS made it choke. If 
anyone can shed some light on this, let me know. 

2. Copy the disk with Super lOB and the control- 
ler. Do not choose to format the target disk 
when Super lOB asks you. 

Controller 

1000 REM MILLIKEN Q&D 

1001 POKE 47426,24: REM *B942:18 
1010 TK = 3:LT = 35:ST = 15:LS = 15:CD = 

WR:FAST=1 
1020 GOSUB 490: GOSUB 610 
1025 RESTORE :T1 = TKiTK = PEEK (TRK): 

GOSUB 310:TK = T1 
1030 GOSUB 490: GOSUB 610: IF PEEK (TRK) = 

LT THEN 1050 
1040 TK = PEEK (TRK):ST = PEEK (SCT): GOTO 

1020 

1050 HOME : PRINT "OK.0(SEOTOR0EDITED0 
WITHONOODOSOONODISK)" 

1051 END 
5(J00DATA20CHANGES 

5001 DATA 17,0,0,4 

5002 DATA 17,0,1,17 

Checksums 

1000-$356B 1025-$86EC 1051-$C310 

1001-$B631 1030-$CE34 5000-$FE07 

1010-$D02A 1040-$2DAE 5001-$593E 

1020-$96A0 1050-$9BCC 5002-$452A 

You are done and can now learn your multi- 
plication tables. 

What Milliken did 

I looked at the chart on page 165 of Tom 
Weishaar's "EX)STalk Scrapbook" and noticed 
that byte $01 of the VTOC (track 17) of DOS 3.3 
disks contains the track containing the VTOC! 
Milliken simply put a $F1 in this location so that 
your copied disk would bomb even if you de- 
feated DOS's error checking with a poke or 
machine-languageCLC. Your copieddisk would 
attempt to access track #24 1 and die. The control- 
ler changes bytes $00 and $01 of the track 17 so 
DOS 3.3 gets what it wants. (Quite honestly, I 
don't know what byte SOO is supposed to be, but 
DOS 3.3 disks have a $04 there, so that's what I 
put there.) 

©If you notice on page 8a of issue #64, 
Leonard Nadel asked for a krack and enhance- 
ment to Apple Writer II. I, too, am in need of such 
an item. No one ever replied. Ifyou have akrack 
to Apple Writer, send it in! Mr. Nadel, ifyou ever 
obtained one, please contact me. 
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® I am also in need of AppleWriter lie Pro- 
EXDS. I have the DOS 3.3 version, but Apple no 
longer markets AppleWiiter. If anyone knows 
where to get a copy, my address is 1005 Green- 
brier, Galion, OH 44833. 

® I would also like to get a copy of the IIGS 
sales demo. Any help, please? 

An appeal for sanity: Please put your table of 
contents, if possible, on the front cover like you 
used to. It makes life easier. Also notice that I 
referred to past issues in my article with an issue 
number AND A PAGE NUMBER WITH A 
COLUMN (a,b,c, etc). Please, gentle readers, do 
the same whenever you write to Computist in the 
future. Nothing is more maddening than trying to 
find a past article that is referred to as, "In issue 
#xx, etc.". Adding a column letter aids finding 
things quickly. If Computist readers have a uni- 
form method of correspondence, the planet will 
rotate much faster. 



Stingray 



Canada 



Well, I guess it's about time I wrote some- 
thing again. It's been a long time, but I've been 
pretty busy with my first year of university. 
Finally, everything has settled down to routine, 
and I've got some free time on my hands. 

ProDOS Boot Disassembled 

While looking through my back issues of 
Computist, it occurred to me that nobody has 
taken a really in-depth look at the boot segment 
for ProDOS, and it's about time because it could 
be very valuable, not to mention interesting, to 
know just how ProDOS gets itself up and run- 
ning. Pay attention, some of this is paretty com- 
plex. 

First of all, some necessary miscellaneous 
info. As most of you know, ProDOS stores its 
data in blocks, instead of sectors. Each block is 
made up of two EXDS 3 .3 sectors. Table 1 shows 
which sectors form which blocks, n is any even- 
numbered track. X is one-half of n. 

Table 1 



Block 


Track 


Sectors 


xO 


n 


O.E 


xl 


n 


D.C 


x2 


n 


B.A 


x3 


n 


9,8 


x4 


n 


7,6 


x5 


n 


5.4 


x6 


n 


3,2 


x7 


n 


1,F 


x8 


n-i-l 


0,E 


x9 


n-H 


D.C 


xA 


HH-l 


B.A 


xB 


nn-l 


9,8 


xC 


n-i-1 


7,6 


xD 


nn-l 


5.4 


xE 


n-i-1 


3,2 


xF 


n-i-l 


l.F 



The next thing we must clarify is the differ- 
ence between logical and physical sectors. Imag- 
ine that sectors are arranged in numerical order as 
you go around the track. When you read a file, the 
data is often stored on sectors that are in numeri- 
cal order. A problem arises; it takes time to 
decode a sector. When you have finished reading 
and decoding sector 1, sector 2 has already gone 
past the read write head, because the disk is 
spiiming constantly. You have to wait one revo- 
lution before you can read sector 2, slowing 
access time to a crawl. Now imagine the sectors 
are arranged like this: sector 1, another sector, 
then sector 2. This is much better, because you 
can read sector 1, decode it while the other sector 
goes by, and instantly read sector 2. The skew 
that DOS 3.3 and ProDOS use is called 2-De- 
scending. Table 2 shows the physical and corre- 
sponding logical sectors. Please note: the logical 
sectors are the numbers you have always used to 
specify sectors. The physical numbers refer to 
the actual location of that sector on the track. 

Table 2 

Physical: 0123456789ABCDEF 
Logical: 07E6D5C4B3A2918F 

The boot segment is located on block 0, that 
is track 0, sectors and E. When a ProDOS disk 
is booted, 0/0 loads normally, as in DOS 3.3. This 
is the only similarity between the two. Let's look 
at the first bit of the code. 



800 


01 


801 


SEC 




BCS 807 




JMP A132 


807 


STX 43 




CMP #03 




PHP 




TXA 




AND #70 




LSR 




LSR 




LSR 




LSR 




ORA #C0 




STA 49 




LDY #FF 




STY 48 



Okay. TTie 01 is used by the disk controller. It 
means only load sector 0, just as in DOS 3.3. 1 
have no idea why they do that branch around the 
jump. You might as well just go straight to 
$0807. When execution is passed to this code 
from the controller card, the accumulator holds 
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the next jrfiysical sector to be read, and the X 
register holds the boot slot in its hi nibble. There- 
fore, $43 now holds the boot slot times 16. The 
effect of the next two lines depends on whether 
we just read sector or sector E. If we read 0, A 
holds 1, and when we do the compare, the carry 
is clear. Then the PHP saves this result. The rest 
of the commands put the value CnFF into $48 and 
$49, where n is your boot slot. 
BIB 



823 



PLP 




INY 




LDA 


(48),Y 


BNE 


85B 


BCS 


831 


LDA 


#03 


STA 


0800 


INC 


3D 


LDA 


49 


PHA 




LDA 


#5B 



The PLP restores the result of the CMP in- 
struction. Recall that if we read sector 0, the carry 
is clear, and if we read sector E, it is set. The Y 
register is incremented to zero, and since $CnFF 
is always zero (at least on a Disk n card), the first 
branch is never taken. The rest of the code pre- 
pares for reading sector E. $0800 is set to $03, so 
that only sector E will be read, $3D (the physical 
sector to be read) is incremented to $02, and 
control is passed to the controller card via a 
planned RTS. When sector E has been read, the 
above code is re-executed from $0801, except 
the branch to $0831 occurs this time. 

831 
837 



843 



STA 


40 


STA 


46 


LDY 


#63 


LDA 


(48).Y 


STA 


0994,Y 


INY 




CPY #EB 


BNE 


837 


LDX 


#06 


LDY 


091 D,X 


LDA 


0924.x 


STA 


09F2,X 


LDA 


092B,X 


STA 


0A7F.X 


DEX 




BPL 


843 



This is a nifty idea on Apple's part. Instead of 
taking up space on the disk with code to read a 
sector, they copy the code from $Cn63-$CnEB to 
$09F7-$0A7E, and modify it a bit to suit its new 
location. $09 1 D is a table of offsets from $09F2, 
and $0924 is a table of one-byte modifications for 
those offsets. $092B is a small piece of code that 
is tacked on the end. at $0A7F. 
855 



858 



LDA 


#09 


STA 


49 


LDA 


#86 


LDY 


#00 


CMP #F9 


BCS 


890 


STA 


48 


STY 


60 


STY 


4A 


STY 


4C 


STY 


4E 


STY 


47 


INY 




STY 


42 


INY 




STY 


46 


LDA 


#0C 


STA 


61 


STA 


4B 



This code sets up some new pointers. ($48) 
has served its purpose in moving the sector read 
code, so now it holds $0986, a subroutine which 
converts ProDOS block numbers to tracks and 
sectors. ($4A) holds SOCOO, which is where the 
root directory will be loaded. ($60) is the load 
buffer address, $0C0O, and ($46) holds $0002, 
the first block to be loaded. 

879 JSR 0912 

BCS 8E6 
INC 61 
INC 61 
INC 46 
LDA 46 
CMP #06 
BCC 879 

This code reads blocks 2-5 into memory from 
$OC0O-$13FF, using $0912, the block read sub- 
routine. Notice the data buffer is incremented 
twice for each block (two-sector) read. 

88A LDA OCOO 

ORA 0C01 

BNE 8FF 

LDA #04 

BNE 898 
896 LDA 4A 

898 CLC 

ADC 0C23 

TAY 

BCC 8AC 

INC 4B 

LDA 4B 

LSR 

BCS SAC 

CMP#OA 

BEQ 8FF 

LDY #04 
8AC STY 4A 

Here we begin searching the root directory for 
the PRODOS file. The first two bytes must both 
be zero (I don't know why) or we branch to 8FF 
(it prints UNABLE TO LOAD PRODOS). We 
first set $4A to 4, to skip the first four (unused) 



bytesof the root directory. Then we addthevalue 
in $0C23 ($27, the length of a file entry) to it to 
get the offset of the first file. If the carry is clear, 
we haven't crossed a page boundary yet, so goto 
$08AC. If it is set, increment $4B, the high byte 
of the index. The root directory only goes up to 
page$13,soif$4B is 14, and it gets LSRed, it will 
become A. When this happens, we havereached 
the end of the root directory without finding 
PRODOS, causing an error and a branch. If we 
don't branch, LDY with 04 again, and store it in 
the index. 

8AE LDA 0902 

AND #0F 

TAY 
8B4 LDA (4A),Y 

CMP 0902,Y 

BNE 896 

DEY 

BPL 884 

AND #F0 

CMP #20 

BNE 8FF 

LDY #10 

LDA (4A),Y 

CMP #FF 

BNE 8FF 

$0902 is a data table that holds the value 26 
and the word PRODOS . The value of 26 is rather 
important, and I will explain it in detail. 

Every file has a byte before its name. Tlie low 
nibble(6 in this case) is the length of the filename. 
If we sector-edited this value to 24, only PROD 
would be recognized as a filename. The high 
nibble is the storage type. This is different from 
the filetype. It depends mainly on how long the 
file is. Some Apple terminology: a seedling file 
is less than one block long, so it doesn't require 
a BAM, just one data block. Seedling files are 
one block long. A sapling file has 2-256 data 
blocks, plus a BAM to keep track of them. A tree 
file has more than 256 data blocks, plus a master 
BAM, whichholdspointersto 128regularBAMS, 
each of which can point to 256 data blocks. 
Therefore, a tree file can be an astonishing 16 
Meg long. There are several storage type codes. 
They are as follows. 

Code Filetype 

1 seedling 

2 sapling 

3 tree 

D subdirectory 

F volume header 

(there might be others...) 

S08AE puts Y equal to 6, the length of 
PRODOS . Then the filename of the current file is 
compared to $0902. If it doesn't match, goto 
$0896 to try the next file. If it does match (ie We 
found a file called PRODOS), make sure the first 
byte has a 2 in the hi nibble (ProDOS is a sapling 
file). Last, make sure the filetype is SYS(FF). 
8CC 



INY 




LDA 


(4A),Y 


STA 


46 


INY 




LDA 


(4A).Y 


STA 


47 


LDA 


#00 


STA 


4A 


LDY 


#1E 


STY 


4B 


STY 


61 


INY 




STY 


4D 



Now, get the first block in the file from the file 
description. This will be the BAM, or block 
allocation map, for the file. Set the address of the 
low bytes into ($4A), and the high bytes into 
($4C). These are $ 1 EOO and $ 1 FOO, respectively. 
Page IE will hold the low bytes of the block 
numbers, and page IF will hold the high bytes. 
On a floppy, these will be either zero or one. 
8E3 



JSR 


0912 


BCS 


8FF 


INC 


61 


INC 


61 


LDY 


4E 


INC 


4E 


IDA 


(4A).Y 


STA 


46 


LDA 


(4C),Y 


STA 


47 


ORA 


(4A),Y 


BNE 8E3 


JMP 


2000 


JMP 


093F 



8FF 

This routine actually loads PRODOS into 
memory. S4E is the index into the BAM. As long 
as there is a block to load, the ORA will produce 
a non-zero result, and we will branch back to the 
read subroutine. As soon as we run out of blocks 
to read, it will be zero, and we will jump to S2000, 
to begin executing the PRODOS file itsel f $08 FF 
just jumps to S093F to print the error and hang. 
We are now half-finished disassembling the 
loader. Whew!!!! 



902 


26 PRODOS 


912 


LDA 60 




STA 44 




LDA 61 




STA 45 




JMP (0048) 


91 D 


08 1E24 3F 454776 


924 


F4D7D1B64BB4AC 


928 


LDX 28 




CLC 




RTS 




JMP 09BC 


932 


LDA #9F 



PHA 

LDA #FF 
PHA 
LDA #01 
LDX #00 
JMP_F479 

$0902 holds the name of the file the loader 
looks for. You can change it, just make sure you 
adjust the filename leng A in the first byte. $09 1 2 
is the main entry to the block read routine. It sets 
($44) to the data buffer and jumps to the block 
nimiber translate routine. $091d is a table of 
offsets, $0924 is a table of modifications, and 
$092B is a short piece of code, all used to modify 
the segment copied from the disk controller card. 
I don't think $0932 ever gets executed. 
93F 



944 



94D 
950 
96D 



97A 
97C 



JSR 


FC58 


LDY 


#1C 


LDA 


0950,Y 


STA 


05AE,Y 


DEY 




BPL 


0944 


JMP 


094D 


*" UNABLE TO LOAD PRODOS 


LDA 


53 


AND #03 


ROL 




ORA 28 


TAX 




LDA 


C080,X 


LDA 


#20 


LDX 


#11 


DEX 




BNE 


097C 


SBC 


#01 


BNE 097A 


LDX 


2B 


RTS 





$093F is the general failure message. $096D 
looks like part of a routine to move the disk arm. 
If there is anybody out there with the knowledge 
to write a highly detailed explanation of just how 
the disk arm is controlled, please do so. I am 
working on it, but progress is slow. 

986 • 



994 



LDA 


46 


AND #07 


CMP #04 


AND #03 


PHP 




ASL 




PLP 




ROL 




STA 


3D 


LDA 


47 


LSR 




LDA 


46 


ROR 




LSR 




LSR 




STA 


41 


ASL 




STA 


51 ■ 


LDA 


45 


STA 


27 


LDX 


28 


LDA 


C089,X 


JSR 


09BC 


INC 


27 


INC 


3D 


INC 


3D 


BCS 


0988 


JSR 


09BC 


LDY 


C088,X 


RTS 
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This routine converts a block number into a 
track and physical sector number, then calls the 
readsec tor routine. From S0986,theblocknumber 
is read, converted to a sector number, and stored 
at S3D. From $0994, the track is found and stored 
at $4 1 , doubled and stored at $5 1 . The data buffer 
is stored at $27, the drive motor is switched on, 
and $09BC, the read routine, is called. The buffer 
is incremented, the sector is incremented twice, 
and we read the second sector. I beUeve the BCS 
represents an error in reading a sector. $09B8 
turns the drive off and exits. 

The rest of the code, from $09BC to $0A86, 
which includes the part from the disk card, reads 
a sector into memory, moving the arm if needed. 
I haven't totally analyzed the code, but I know 
that is what it does. 

So that is how ProDOS gets itself into mem- 
ory. The firstpart of the ProDOS file itself is even 
neater. It looks around your system, identifying 
such things as what type of Apple it is miming on, 
how much memory there is available, what kind 
of drives and clocks you have, etc., and saves all 
this info in something called the Global Page. 
This is basically ProDOS 's own personal zero 
page, and BASIC.SYSTEM also has one. 

Notes on Tetris 

1 was trying to crack Tetris for the//e, having 
noticed it on the most wanted list. 1 can honestly 
say the RWTS for this game, which by the way is 
identical to that of a game called Prince of Persia, 
is one of the most awesome pieces of code I have 
ever analyzed. 

A brief overview: There are eight basic com- 
mands for this disk driver. They are as follows. 

drive on 

1 drive off 

2 seek track 

3 linear read 

4 custom read 

5 linear write 

6 custom write 

7 modify sector data header 

The syntax for a call to the RWTS is like that 
for MLI. You call the main entry, with a parmlist 
right after the call, the length depending on the 
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command. has the syntax JSR RWTS xO x# dd. 
The parmlist is 3 bytes long, x is any number, 
is the command code, # is the drive number, dd is 
the delay for the drive to come up to speed. 1 has 
only one parm, xl, or just the command. 2 goes 
like this: x2 rr ##. If rr is zero, don't recalibrate 
the arm, if it is not zero, do so. ## is the track 
number to seek. 

Now for the really neat part. The way this 
program encodes the data to store it, you get not 
1 6, not 17, but 1 8 pages per track. That's right, 1 8 
sectors per track. There are, of course, strings 
attached. You have to read and write an entire 
track at a time. This is because the 18 pages are 
all jumbled together into 5 large sectors. One 
other particularly devious pieceof programming: 
the encoding routine uses part of the boot as a 
key, meaning if you change ANYTHING on that 
one page, you change the way the data is encoded 
and decoded. There are two ways to read and 
write, which I call linear and custom. You either 
call x3 pp, where pp is the first page of a linear 
block of 1 8 pages to read, or you call x4 pp pp pp 
... , with a list of 18 assorted pages to read. Write 
works the same way. Routine 7 changes the byte 
written between sectors. 

To sum up, I don't think it is possible to crack 
these games, as there are write routines in the 
game that use these custom formats. The only 
solution I see is a program to copy this custom 
format as is. 



CA 



Steve Lawrence 

® Help! I have "Hacker E" for the Ilgs but it 
doesn' t work with the version 01 ROMs. It errors 
out and says, "Unclaimed Sound Interrupt". 
Mediagenic had a fix but it is no longer available. 
Does anyone know what the bytes to change are 
and the softkey? 

Norman Hogarth 

. © Does anyone have information on ho w to 
reach "Alpha Logic Business Systems"? Contact 
me on the Computist BBS (user #992). Thanks. 



FL 



Lee Lovinger 

©I'm really interested in interrupts on the 
Ilgs. Can anyone write an article on this subject? 



Melvin Long 



Canada 



©I purchased "Alien Mind" by PBI and I've 
got a problem. The boot disk works fine except 
for the odd glitch in the joystick control. But 
when I play up to the point where the program 
asks for the second disk, and I insert the second 
disk, the program won't recognize it. It keeps 
asking for the second disk. I tried to contact PBI 
but my letter was returned and there is no answer 
at their number. Does anyone know how to make 
the program recognize the second disk? 

IBM RDEX IBM RDEX IBM RDEX 
Jim Bello 

IBM Softkey for... 

Paladin 

Omnitrends 

This patch will remove the jump to the docu- 
mentation check in Paladin. 

Use PCtools or Norton to search for 3B 46 FC 
75 OB and change the 75 OB to 90 90. 

The Docimientation check window will still 
appear, but just hit return and the program will 
nm. 

Damien Norrts 

IBM Playing Tip for... 

Pool of Radiance 

I found a nifty way to cheat on Pool of 
Radiance, (well, it's not REALLY cheating, I 
think.) If there are hordes of really tough mon- 
sters (like the hobgoblins, ores and trolls in Sokol 
keep), then you go to the training hall, say yes to 
training so you get that first party creation menu. 
Now (R)emove all the players except your fastest 
guy. Now, go to the hall and rent two fighters (not 
good guys) and put them ahead of your fast man. 
Go to the fight and let the fighters block the 
monsters and get slaughtered as your one charac- 
ter runs away. When the battle is over, you will 
get all the items the monsters had, plus the 
encounter will no longer happen... it's just the 
same as winning, but easier! 



Les B. Minaker 



Canada 



IBM Playing Tip for... 

Curse of the Azure Bonds 
Strategic Simulations Inc. 

How to increase your magical stores 
(without attending college) 

In the game, some really neat items only 
occur once. This can be a pain if you would like 
to equip all you fighters with +5 long swords and 
Girdles of Storm Giant Strength or maybe your 
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magic-user really needs an extra necklace of 
missiles. The below listed process gives detailed 
instructions to duplicate important items found 
in the game. 

1. Trade all important items to one character 
(ie. Benny). 

2. Remove Benny from the party. 

3. Add Bermy back into the party. This writes 
a file for Bermy. 

4. Remove him again, responding "N" to the 
overwrite option and make up a new name for the 
character (ie BennyA). This writes a file for 
BennyA that is the same as Benny. Now we have 
two characters with the same magic items, gold, 
attributes, et cetera. 

5. Choose "Add a Character" and pick Ben- 
nyA. 

6. Trade all items to other party members. 

7. Remove BennyA from the party. Respond 
"N" to overwrite option. Again make up a name 
(BennyB). 

8. Repeat from step 5 as needed. 

Notes: Remember to drop all made up charac- 
ters after you're done. Multiple occurrences of a 
name can confuse, be careful! This can also be 
used to increase money or copy good characters. 

Magic Items can Be Found Where? 

This list is not complete, but it's all I can 
remember! 

Item: 

Wand of Lighting 

+3 Plate Mail 

Dust of Disappearance 



Location: 
Dead Cleric in Yulash 
Dark Elf in Wizard's Tower 
Fire Knives armoury 



Girdle of Storm Giant Strength Dead man's treasure in 

Myth Drannor 
+3 Mace Salamander's caves 

Ring of Protection (+2) Elven Queen in Myth Drannor 

Combat Tips 

1 . Cast invisibility on your thief and have him 
try and backstab the monsters. 

2. Area affect spells are wonderful. Be careful 
not to damage your party! 

3 . Have the magic-user cast Hold Monster on 
really strong monsters. If they are held, have 
another character attack with missile weapons - 
one hit and they're history! 

4. Rings of protection increase saving throws. 

5. Some monsters resist magic (Drow - 50%, 
Beholder - 100%). Attack these at hand-to-hand 
range as quickly as possible. Beware, Drow 
weapons will decay when you exit an under- 
ground location. 

IBM Playing Tip for... 

Champions of Krynn 

Strategic Simulations Inc. 

How to Increase Your Magical Stores 
(Without Working Up a Sweat!) 

In the game, some really valuable items only 
occur once. This can be a pain if you would like 
to equip all you fighters with -h2 long swords. 
Girdles of Giant Strength and Footman's 
Dragonlances, or maybe your magic-user really 
needs an extra Wand of Fireballs. The below 
listed process gives detailed instructions to du- 
plicate important items found in the game. This 
method works for the IBM version and has not 
been tested on other versions. I have no reason to 
suspect that SSI handles the files all that differ- 
ently on different operating systems. 

1. Trade all important items to one character 
(ie. Frostflower). 

2. Remove Frostflower from the party. This 
writes a file to disk for Frostflower. 

3. Add Frostflower back into the party. The 
file written above is not deleted. 

4. Remove her again, responding "N" to the 
overwrite option and make up a new name for the 
character (ie Catlin). This writes a file for Catlin 
that is a copy of Frostflower (and the file written 
above is still on the disk). Now we have two 
characters with the same magic items, gold, at- 
tributes, et cetera. 

5. Choose "Add a Character" and select Cat- 
lin. Catlin then joins your party. 

6. Trade all items to other party members. 

7. Remove Catlin from the party. Respond 
"N" to overwrite and make up another name such 
as BeerBarrel. 

8. You can repeat from step 5 as needed. I 
must stress that as long as you do not overwrite 
Frostflower, you should have no problems. To be 
safe, try it with an unimportant character first! 

Notes: BeerBarrel is a dummy character. As 
stated above, this was only tested on an IBM PC. 

You Say Your Party Was Devastated by 
Those Pesky Dragons? 

When your party has been nearly killed in a 
particularly nasty fight, but you don't want to 
reload from your last save position, the following 
can help save your bacon in the middle of a 
dungeon (or whatever). This method allows you 
to keep the experience earned by the still living 
characters and continue on with your quest with- 
out having to fight your way out of a hostile 
dungeoii with a seriously weakened party. 

1 . As an initial step (before you get in trouble) 
remove each member from your party and then 
add them back into it. Next, remove each member 
again, but do not overwrite. Make up a new name 
- 1 suggest the original name plus one character or 



number. After each member has been removed, 
add them back in again. That's it for preparation. 
Note: Whenever you exit to begin the game, 
all characters that are with your party will have 
any files that were written above deleted; this is 
the purpose behind creating a different name. 

2. After the fatal (for at least some members) 
combat immediately save the game and exit to 
DOS. This of course assumes that one or more 
player characters survived! 

3. Restart the game. 

4. Remove any of the dead characters from 
your party. You should drop the dead characters. 
Repeat for each character. Then add in the dupli- 
cate characters written above. 

5. When you finally get out of the dungeon, 
repeat step 1. 

IBM Softkey for... 

Pool of Radiance 
Strategic Simulations Inc- 

Requirements: 

PC-Tools or Norton Utilities 

I was getting really armoyed at the copy 
protection with this game, so I got out my sector 
editor and started poking around. Eventually I 
found the answer. 

First install the program normally by unarcing 
it onto your hard drive or 7 floppies. 

Note: I had absolutely no luck unarcing it onto 
floppies. It took me an hour and didn't even run! 
(But, it did install to the hard drive O.K.) Part of 
the install is configuring the program for your 
system. 

Once you have the program installed: 

1 . Find the file named START.EXE and rename 
it to something else like STARTBAK.EXE. 

2. Copy the file STARTBAK.EXE to 
START.EXE. This renames the original and 
makes the copy the executable program. 

3. Using PC-Tools VIEW-EDIT mode or Norton 
Utilities Hex Editor, call up the file 
START.EXE. 

4. Find the 13 following words with the Hex- 
Editor and change each one to HAHAHA (or 
any 6 Capital letters - not lowercase! ) and save 
the changes to disk in the file START.EXE : 

BEWARE ZOMBIE 

NOTNOW COPPER 

DRAGON EFREET 

FRIEND JUNGLE 

KNIGHT SAVIOR 

TEMPLE VULCAN 
WYVERN 

5. When you enter the program and are asked for 
the code from the Translation Wheel, type 
HAHAHA and you're in! 

That's all there is to it. It is understood, of 
course, that this unprotect is only to be used by 
legitimate owners of the game - who have tired of 
spirming that &%@# code wheel! 

Bart Montgomery 

IBM Softkey for... 

Zany Golf 

As a programmer, I hate to see such a cute 
little gem of a game contain any eyesore or flaw. 
In the case of "Zany Golf, the eyesore is the 
request to enter a code from a code- wheel before 
proceeding on to the second hole. Accordingly, I 
have developed a patch so that this "enter code" 
request is not made and the game proceeds as 
normal. 

For those people familiar with the sector 
editors found in PC -Tools and Norton's Utilities, 
you may perform the patch as follows: 

To patch ZANY.COM 

Search for 84 CO E8 15 61 and replace the 84 
with C3. 

To patch TZANY.COM 

Search for 84 CO E8 10 61 and replace the i: 
withC3. 

The Company of Wolves 

IBM Softkey for... 

Paperboy 
Mindscape 

Requirements: 

Norton Utilities (or similar program) 
A copy of the file's papercga.exe, papercgt.exe, 
and papercg2.exe from your original disk. 

1 . First load one of the above files (whichever 
applies to your graphics, papercga for CGA 
graphics, papercgt for tandy graphics , or 
papercg2 for EGA graphics) into Norton. 

2. Search for 3D 33 00 75 FE and change the 74 
FE to 90 90. Save the changes. 

The program will still look for the copy pro- 
tection files DEMAA.COM and DEMAB.COM 
but will skip the instruction that locks up the 
system (74 FE (jump back two bytes if compari- 
son is not zero)). 

If you have any problems with any of the 
patches above clieck the date of the file 
PAPERxxx.EXE on your original disk A for the 
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date 06/17/88. If your file has a different date 
then they probably changed the copy protection 
method and your out of luck with this patch. If 
you have any questions leave The Company of 
Wolves a message, I can be reached on EXCEL 
BBS (414)789-4210. Also included is another 
patch for a different version of Pajjerboy in case 
you have a different version from the one I have. 

UNK 

IBM Softkey for... 

Silpheed vl.O 



Just use PCtools or equivalent and search 
SIERRA.EXE for EB BB and change to 90 90. 
Now all you have to do is hit ENTER at ship 
question and it will bypass it. This will only work 
if you choose harddrive from the INSTALL 
program! 

Brian H. Lawler 

IBM Softkey for... 

Pete rose Pennant Fever 
Gamestar 

This utility will patch Pete rose Pennant Fever 
by Gamestar to run without going blind reading 
black print on dark red paper. After the patch is 
in place, the program will quit asking for a code 
number. 

Do not do this to your original disk. 

ren baseball.exe basebail.bin 

debug basebail.bin 

E 0840 90 90 90 

W 

Q 

ren basebail.bin baseball.exe 

Notice: Lawler Microsystems provides this 
patch to relieve LEGAL OWNERS of Pennant 
Fever the hassle of searching the code sheet 
before playing a game of baseball. I feel that this 
form of copy protection is as much a pain in the 
rear as any other. 

Brian H. Lawler 

Lawler Microsystems 

#3 Evergreen Drive 

Saint Joseph, MO 64505-9661 

Howard A 

IBM Playing Tip for... 

Test Drive II 



Recently I posted the following to get you to 
the next gas station in Test Drive II: 

aerf ,bruce 6outran bgasst 

Upon further practice I have determined the 
following: By just typing "aerf, without the 
quotes, it gives your car super acceleration and 
quick braking. For a comparison select the Cor- 
vette and the track that came with the disk. Use 
the easiest level. I had previously been unable to 
get the 'vette into 6th gear. But after typing aerf, 
it is no problem. The same test is good when 
trying to stop between the white lines at the gas 
station.By just typing "bgass",withoutthequotes, 
the program will take you to a position just before 
the first white line at the gas station. If you 
accelerate and stop between die white lines you 
will have a super average MPH. Race against the 
computer and type the above and notice how the 
computer's car (the blue dot at the top) is at the 
location when you typed the above. I averaged 
something like 5,600 MPH and got a score of - 
561,000. 

Please note this showed up on the high score 
as a negative number. If you just want to skip a 
particular segment, I recommend that you type 
the sequence below. BY just typing "bgasst", 
without the quotes. This has the same effect as the 
first mondo sequence I posted. Actually, type 
bgass and you will see the gas station follow that 
with a "t", no quotes, and that round will be over. 
Your average speed will be based on your actual 
average speed. Sorry I didn't determine all of this 
earlier. I guess I was in a rush to get it posted. By 
the way if anyone finds out what the ,bruce and 
6outran do, please let me know. 

UNK 

IBM Hardkey for... 

Redstorm Rising 



Put Redstorm Rising on Harddrive 

This softkey will allow Redstorm Rising to be 
run from Harddrive 

without a key disk. There can not be any disk 
in drive A: When 

the Program Reads drive A:. 

You will still need to ID the correct ship to run 
the game right, I can't find a way to get around 
that. Using PCtools (or some such) edit 
Redstorm.com. Go to sector 6, offset 221 and 
change the BD to an 8D. Then go to sector 6, 
offset 344 and change the C3 to 00. That's it! 
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unCIassifieds 



How to place an UnClassifled Ad 

Send a typed sample copy with appropriate instructions. (If 
possible, send text on a 5.25" Apple format disk.) Use up to 40 
characters per line, we will adjust word wrap. 

Special Graphics Instructions: The first three words of the 
first line are printed in bold for free. If you want other words 
bolded, use 5 characters less per line. Use 10 characters less per line 
if you have a lot of uppercase bold letters. Bold letters are wider 
than normal. If the typed copy does not show bold, circle the words 
you want bolded and, on the side, write BOLD. If you want a line 
centered, write CENTER next to that line. There is no charge for 
centering any line. 

You must check your ad for errors, the first time it runs. Errors 
on our part will be corrected, thai, for free. Errors of changes on 
your part will be charged a $5 processing fee. 

*•*• New Rates (per line) **** 

Computist club member 250 

All others 350 

The minimum order is S5* 

Our liability for errors or omissions is limited to the cost of the 
ad. 

We reserve the right to refuse any ad. 

Washington state residents add 7.8% sales tax. 

Send a check or money order (funds drawn on US bank only) 
for the entire amount to: 

COMPUTIST unCLASSIFlEDS 

33821 East OrvUle Road 

EatonvUle, WA 98328 



RENT or BUY Has SOFTWARE 

• Money Back Guarantee 

• Catalog contains over 200 titles 

• Rent for 15% - 20% of list price 

• Prices comparable with mail order 
Rental fee discounted from purchase price 
• $15 Lifetime Membership Fee 

GSoft 

7350 Ulmerton Road #924 

Largo, Florida 34641 

(813)536-4352 



SCSI MASS STORAGE FOR LESS 

40 Meg $450 

60 Meg $520 

80 Meg $570 

44 Meg (removable "/cartridge) $650 

extra cartridge $95 

All Seagate hh drives, case, power supply, 
fan and SCSI cable included. 

Just plug and go ! ! ! ! 

GSoft 

7350 Ulmerton Road - Suite 924 

Largo, Florida 34641 

(813) 536-4352 



TRADE YOUR APPLE SOFTWARE 

Send your list of programs to trade, I have 
over 120 originals to trade. 

Byron Blystone 

PO Box 1313 

Snohomish, WA 98290 



Software — Books — Magazines 

We buy & sell out-of-print & hard-to-find 
Apple II originals, old and new. Send $1 for 
catalog. 

Frank Polosky 

PO Box 9542 

Pgh, PA 15223 
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Most Wanted 

72 50 Mission Crush SSI 

65 Airheart Broderbund 

63 Alcon Taito 

74 Algebra Shop Scholastic 

63 Alien Mind PBI Software 

73 American History Explorer Series Mindscape 

74 Animal Kingdom Unicom 

74 Animals of the Past Focus Media 

72 Ankh Datamost 

73 AntFami Sunburst 

87 Apple Panic Broderbund 

67 Aquatron Sierra 

69 Axis Assassin ? 

63 Bad Street Brawler Mindscape 

73 Bank Street Beginner's Filer Sunburst 

73 Balk Street School Filer Sunburst 

63 Beyond Zork Infocom 

65 Bilestoad Datamost 

69 Blue Powder - Grey Smoke Grade 

74 Birds Trees & Rowers Focus Media 

63 Border Zone Infocom 

65 Borg Sirlus 

67 Bouncing Kamungas Penguin 

66 Boxing ? 

65 Bureaucracy Infocom 

69 Caverns of CallisiD Origin 

68 Centauri Alliance Broderbund 

69 Checker Odesta 

69 Chess 70 Odesta 

69 Chuck Yeager's Adv Rt Trainer Electronic Arts 

67 C'est La Vie Adventure International 

68 Comics Accolade 

63 Cosmic Relief Datasoft 

65 Crime & Punishment Imagic 

74 Crosscountry USA Diatech 

69 Crossword Magic v4.0 ? 

69 Cybernation NexaCorp. 

72 Cytron Masters SSI 

66 Deathlord Electronic Arts 

74 Decimal Dungeon Unicom 

74 Decisions: Colonization v1 .0 Tom Snyder Productions 

69 Delta Squadron NexaCorp. 

67 Desecration Mind Games 

73 Designer Prints MECC 

66 Disk Optimizer System Nibble Notch 

65 Dondra Spectrum Holobyle 

69 Dragon Eye Epyx 

69 Dueling Digits Broderbund 

68 D&D-Master Assistant vol2 SSI 

62 DROL Broderbund 

72 Epidemic SSI 

67 Epoch Sinus 

63 Explore-Australia Dataflow Computer Service 

74 Exploring Tables & Graphs Level 2 (SU) Weekly Reader 

67 Evolutron Sydney 

Readers Data Exchange 



67 Falcons Piccadilly 

68 Factastics Trivia Daystar 

73 Fisher's Cove Tom Snyder Productions 

69 Fit Wars Sinus 

74 Fraction Action Unicorn 

69 Gemstone Healer SSI 

73 Geometric Supposer (the) Sunburst 

66 GEOS Berkley Softworks 

71 Gertrudes Puzzles ? 

72 Galactic Gladiators SSI 

63 Gladiator Taito 

66 Goldnjsh Sierra On Line 

73 Goodell Diamond Caper Tom Snyder Productions 

67 Gorgon Sirlus 

66 GradeBuster 1 2 3 Grade Buster 

61 Gutenberg Sr. Micromation LTD. 

65 Halls of Montezuma Electronic Arts 

69 Hard Hat Mack ? 

67 High Orbit Softsmith 

67 Horizon V Softsmith 

69 Impossible Mission Epyx 

62 Indoor Sports Mindscape 

68 Infocomics Infocom 

66 Jane ? 

63 Joker Poker Mindscape 

72 Kabul Spy Sirius 

71 Keyboarding Klass Mastery Developement 

68 Kingdom of Facts Santa BarbaraH'hunder Mountain 

72 Lane Mastodon Infocom 

67 Lancaster SVS 

72 Laser Force (llgs) Britannica 

66 Legacy of the Ancients Electronic Arts 

65 Lost Tomb Datasoft 

74 Mammals Reptiles & Amphibians Focus Media 

65 Manhunter New York llgs Sierra On Line 

65 Mavis Beacon Teaches Typing (gs) Software Toolworks 

73 McGraw-Hill Problem-Solving Lvl 5 & 6 Tom Snyder 

74 Micro-Typewriter v1 .3/4.0 S.EWamer 

67 Microwave Cavalier 

66 Might and Magic II Activislon 

73 Mind Castle I MCE Inc. 

69 Minotaur Sirius 

63 Modem MGR MGR Software 

68 Mr. Pixel's Cartoon Kit Mindscape/Thunder Mountain 

73 Mystery of Hotel Victoria Tom Snyder Productions 

63 National Inspirer Tom Snyder Productions 

66 Observatory (The) Mindscape/Lightspeed Software 

74 Ocean Life Focus Media 

66 Odin Odessta 

63 Operation Wolf Taito 

68 Pensate : Datasoft/Sofldisk 

69 Phantasiell SSI 

67 Phantoms 5.. Sirius 

67 Pig Pen Datamost 

74 Plants & Animals of the Desert Focus Media 

67 Project: Space Station Avantage 

67 Pulsar II Sirius 

68 Pure Stat Basketball ? 

62 Quadratic Equations II Olympus Educational Software 

63 Questronll Electronic Arts 

68 Rails West SSI 

63 Rastan Taito 

67 Rear Guard Adventure Intemafional 

63 Renegade Taito 

67 Rescue Raiders Sir Tech 

67 Rings of Satum Level 10? 

63 Rocket Ranger (llgs) Cinemaware 

69 Roundabout Datamost 

63 S.D.I, (llgs) Cinemaware 

72 S.E.U.I.S SSI 

62 Sea Stalker Broderbund 

67 Serpentine Broderbund 

74 Seven Cities of Gold Electronic Arts 

68 Skeletal System Brainbank 

63 SkyShari< Taito 

63 Sound Song & Vision Advanced Software 

67 Space Ark Datamost 

62 Spare Change Broderbund 

67 Spectre Datamost 

62 Speedy Spides Readers Digest 

67 Star Cruiser Sirius 

67 Star Maze.... Sir Tech 

63 StickyBear Math: Add & Subtract Optimum Resources 

68 Sticlqrbear GS Versions 3.5 Xerox 

63 Strike Fleet Electronic Arts 

67 Succession Piccadilly 

65 Superstar Ice Hockey Mindscape 

61 Superstar Indoor Sports Mindscape 

74 Surveys Unlimited Mindscape 

68 Talking Text Writer GS Scholastic 

68 Tangled Tales Origin Systems 

69 Tetris (lie) Spectrum Holobyte 

72 Theatre Europe PBI 

74 The Other Side v2.0 Tom Snyder Productions 

65 Thunder Chopper ? 

63 Ticket to Washington D.C Blue Uon Software 

74 Time Exptorers Gameco 

74 Time Liner vl.1 Tom Snyder Productions 

63 Tomahawk Electronic Arts 

68 Tomahawk (llgs) Datasoft 

69 TtackAttack Brodertxind 

68 Triad Thunder Mountain 

72 Triango (llgs) Califomia Dreams 

68 Trinity Infocom 

73 Unicom 5.25" software Unicom 

73 Vincent's Museum Tom Snyder Productions 

68 Volcanoes v1 .8 Earthware Comp. Services 

66 War in the Middle Earth Melboume 

61 Wasteland Electronic Arts 

67 Wayout Sirius 

63 Wings of Fury Broderbund 

63 Wizardry:RetumofWerda Sir-Tech. 

■ 68 Word Attack Plus (llgs) Davidson 

65 Works (the) First Star Software 

67 Zenith Softsmith 

63 ZorkQuest Infocom 

IBM Most Wanted 

72 GBA Championship Football Electronic Arts 

68 Graphitti George Best Phillips Academy 

61 Gunship Microprose 

63 Heros of the Lance SSI 

72 Kings Quest III Sierra 

72 Operation Wolf Taito 

72 Radio Baseball Electronic Arts 

72 Ultima V Origin 
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We finally completed the move to Eatonville. Everything is gone from 
the Tacoma location. But there's a problem. I don't have enough space to 
store all the boxes. So here's a deal for you: 



The Book of Softkeys 

(volume 1-3) for only $1* each 

*plus postage & handling 



Book of Softkeys I (Compiled from issues! -5) 

yoM^ef a// o/tAesc«i^feryj;«Akalabeth«Amper-Magic«AppleGalaxian "Aztec 'Bag of Tricks 
•Bill Budge's Trilogy of Games 'Buzzard Bait •Cannonball Blitz Oasino •Data Reporter 
•Deadline •Disk Organizer 11 'Egbert 11 •Hard Hat Mack 'Home Accountant •Homeword 
•Lancaster •Magic Window 11 •Multi-Disk Catalog 'Multiplan •Pest Patrol 'Prisoner II •Sammy 
Lightfoot -Screenwriter 11 -Sneakers •Spy's Demise •Starcross 'Suspended 'Ultima 11 'Visifile 
'Visiplot 'Visitrend •Witness •Wizardry •Zork I 'Z«rk 11 'Zork lU 

Plus: 

How to crack Applesoft program disks 

Introduction to Boot Code Tracing 

How to create DeMuffin (A disk cracking tool) 

Diskedit (Make changes directly on your disks) 

Diskview (Examine protected disks) 

Getting on the Right Track (Fix your Ap>ple drive so it tells you what track it is on.) 

Hidden Locations on your Apple Revealed 

Fix your Rana drive so you can Boot Code Trace 

Neat tricks and bombs that you can put in your programs 



Book of Softkeys n (Compiled from issues 6-IO) 

You get all of these softkeys: 'Apple Cider Spider 'Apple LOGO 'Arcade Machine 'The Artist 
'Bank Street Writer 'Cannonball Blitz 'Canyon Climbw 'Caverns of Freitag 'Crush, Crumble & 
Chomp 'Data Factory v5.0 'DB Master 'Essential Data Duplicator I 'Essential Data Duplicator 
ni 'Gold Rush 'Krell LOGO 'Legacy of Llylgamyn 'Mask of the Sim 'Minit Man 'Mouskattack 
'Music Construction Set 'Oil's Well 'Pandora's Box 'Robotron 'Sammy Lightfoot 'Screenwriter 
n v2.2 'Sensible Speller IV 'Sensible Speller 4.0c/4.1c 'Spy Strikes Back 'Time Zone 'Visible 
Computer 6502 'Visidex 'Visiterm •Zaxxon 'Hayden Software 'Sierra OnLine Software 

Plus: 

How to create DeMuffin Plus (A disk cracking tool) 
Super IOBvl.5 

Using ProDOS on a Franklin Ace 
Crunchlist 11 
The Controller Saver 

Making Liberated Backups That Retain Their Copy Protection 
Examining Protected Applesoft BASIC Programs 

Game Cheats for: Castle Wolfenstein, Miner 2049er, Serpentine, Star Maze, Ultima II, Wiz- 
ard and the Princess, Wizardry: Proving Grounds of the Mad Overlord, Zaxxon 

Book of Softkeys HI (Compiled from issues 11-15) 

You get all cf these softkeys. -Mien Addition 'Alien Munchies ' Aligator Mix 'Computer Prepa- 
ration SAT 'Cut and Paste 'Demolition Division 'DLM Software •Einstein Compiler v5.3 'Elec- 
tronic Arts Software 'Escape from Rungistan 'Financial Cookbook 'Flip Out 'Hi-Res Computer 
Golf n 'Knoware 'Laf Pak 'Last Gladiator 'Learning With Leeper 'Lion's Share 'Mastertype 
'MatheMagic 'Minus Mission 'Millionaire 'Music Construction Set 'One on One 'PFS Software 
'Penguin Software 'The Quest 'Rocky 's Boots 'Sabotage 'Seadragon 'Sensible Spellw 'Snooper 
Troops (Case 2) 'SoftPom Adventure 'Stickybear BOP 'Suicide 'TellStar 'Tic Tac Show 'Time 
is Money 'Transylvania 'Type Attack 'Ultima III-Exodus 'Tjoom Graphix 

Plus: 

Putting Locksmith 5.0 Fast Copy Into a Normal Biiuuy File 
CSaver: The Advanced Way to Store Super lOB Controllers 
The CORE Disk Searcher 
Modified ROMs 
The Armonitor 



The Hacker's Ultimate Copy & Deprotection Utility; 

The Super lOB Collection! 

ALL four volumes of Super lOB controllers (through issue #65) in "ONE' package! 



COMPUTIST developed the ultimate copy program to remove copy 
protection from software: 

The Super JOB program. 

Since the introduction of Super lOB, COMPUTIST has used this 
flexible program to deprotect (or partially deprotect) dozens of commer- 
cial programs with far ranging protection schemes. 

Super lOB deprotects disks by using a modified RWTS (the subrou- 
tine in DOS which is responsible forthe reading and writing of disk sectors) 
for reading from the protected disk and then using a normal RWTS for 
writing to the deprotected disk. 

This package contains: 

•Three d'sKs (supplied in DOS 3.3). Each disk contains at least 60 
Super iOB Controllers including the standard, swap, newswap and fast 
controllers. Also included is version 1 .5 of Super IOB, the Csaver program 
from COMPUTIST No. 13, and a Menu Hello Program that lists the 
available controllers and, when you select one, automatically installs it in 
Super IOB and RUNs the resulting program.* 

•A reprint of Disk Inspection and the Use of Super IOB, from COM- 
PUTIST f>Jo. 17. This article explains how to write your own Super IOB 
controllers. 

•COMPUTIST No. 32, which contains an extensive article detailing 
the hows and whys of Super IOB v1 .5 and at least 5 articles using the new 
Super IOB program. 

Several of the controllers deprotect the software completely with no 
further steps. This means that some programs are only minutes away from 
deprotection (with virtually no typing). 

The issue of COMPUTIST in which each controller appeared is 
indicated in case further steps are required to deprotect a particular pro- 
gram." 

'Requires at least 64K of memory. 

"Although some controllers wHI^ completely deprotect the program 
they were designed for, some will not, and therefore require their corre- 
sponding issue of COMPUTIST to complete the deprotection procedure. 

The SUPER IOB Collection 

Volume 1 of the Super IOB collection covers all the controllers from 
CXDMPUTIST No. 9 through No. 26. Also included are the newswap and 
fast controllers from COMPUTIST No. 32. The foltowing controllers are on 
volume 1: 

Advanced Blackjack 'Alphabet Zoo -Arcade Machine -Archon II 'Archon 
•Artsd Software -Bank Street Writer •Ban'ons SAT 'Beyond Castle 
Wolfenstein 'BSW/Zc Loader 'Castle Wolfenstein •Computer Preparaton: 



SAT -Dazzle Draw •DB Master 4 Plus - Death in the Carribean -Dino Eggs 
•DLM Software -Electronic Arts •F-IS Strike Eagle •Fast Controller 
-Fathoms 40 -Financial Cookbook -Gessler Software •Grandma's House 
•The Heist -In Search of the Most Amazing Thing-Instant RecaB -Kklwriter 
-Lions Share -Lode Runner -Mastertype -Match Maker -Miner 2049er 
-Minit Man -Mufplot -Newsroom -Newswap controller -Penguin Software 
-Print ShopGraphicLibrary -Print Shop-Rendezvous with Rama-Rockys' 
Boots-Sargonlll -Sea Dragon -Shiela-Skyfox -Snooper Troops -Standard 
controller -Stoneware Software -Summer Games-Super Controller-Super 
Zaxxon 'Swap Controller -TAC -Ultima I & II -Word Challenge -Xyphus 
-Zaxxon 

Volume 2 of the Super IOB collectnn covers all the controllers from 
COMPUTIST No. 27 through No. 38. The following controllers are on 
volume 2: 

Alice in Wonderland -AlphabeticKeyboarding •Alternate Reality 'Autoduel 
•Checkers -Chipwits -Cok)r Me -Conan.data -Conan.prog -CopyDOS 
-Crisis Mountain -Disk Director -Dragonworid -Early Games -Easy as 
ABC -F-15 Strike Eagle -Fantavision 'Fast controller -Fishies -Flight 
Simulator -Halley Project 'Hartley Software (a) -Hartley Software (b) 
-Jenny of the Prarie -Jingle Disk«Kidwriter-Kracking Vol II -Lode Runner 
•LOGO II (a) -LOGO II (b) -Masquerade -Mastering the SAT -Mk:rotype: 
The Wonderful Worid of Paws -Microzines 1 -Microzines 2-5 -Miner 
2049er-Mist&ViewtoaKill -Murder on the Zinderneuf-MusicConstnjction 
Set -Newswap controller -Olympic Decathlon -Other Side -Phi Beta Filer 
•Pitstop II 'Print Shop Companion 'RDOS •Robot War •Spy vs Spy 
•Standard controller -Sundog V2 -Swap controller -Sword of Kadash 
•Synergistic Software •Tawala's Last Redoubt -Terripin Logo •ThreshoM 
-TimeisMoney-TimeZone-TinklTonkNTroll'sTale^UltimalV^Wildemess 
•Word Attack & Classmate •World's Greatest Baseball 'World's Greatest 
Football 

Vohime 3 of the Super IOB colledbn covers all the controllers from 
COMPUTIST No. 39 through No. 53. The foltowing controltets are on 
volume 3: 

2400 A.D. 'Alternate Reality: The Dungeon 'Address Book 'American 
Challenge'AppleGradebookV2.6^Arc«JeAI>um#1 •Arcade Boot Camp 
•Aztec •Bard's Tale II •Beachhead •Beyond Castle Wolfenstein •Black 
Magic •Blue Powder/Grey Smoke •Borrowed Time -Castle Wolfenstein 
•Cat-N-Mouse •Catalyst 2.0 & 3.0 •Centipede 'Champranship Golf 
•Championship Wrestling •Charlie Brown 123'S 'Cokmial Conquest 
•Comprehension Skills •Computer Preparation for the SAT V3 -Coveted 



Mirror •Coveted Mirror RWTS Capture 'CPU68000NV.4Q2 'Cranston 
Manor •Crime Stopper 'Dam Busters •Decimals -Destroyer -Dino Dig 
-Earth Ort>it Station -Encycbpedia Britannica -Escape 'Fish Scales 
-Foundatbn Course in Spanish -Frog -GFL Football -Goonies -Great 
American Cross-Country Road Race -Handlers -H.E.R.O -Inferno 
-Informatfon Master -J-Bird -Jenny's Journeys -Joe Theisman Football 
•Kindercomp -Kung Fu -Light Simulator -Manuscript Manager -Master 
Diagnostics lie -Mastering Math -MECC -MECC Software 'MECC Swap 
•MECC Without RWTS -Missing Links -No Error Check 4 No DOS -Ogre 
-One On One -Oregon Trail •Penguin Software •PFS ProDOS -Pitfall II 
•Puzzles&Posters -Racter -Randamn -Reading Style Inventory -Ring 
Quest 'Science Toolkit •Science Toolkit Rev1 -Skyfox -Snooper Troops 
•Speed Reader II -Spy's Adventure -Starcross -Super Bunny -Temple 
ApshaiTrilogyTheAmericanChallenge^Translyvania^TrollCoutseware 
•Ultima I •Ultima IV 'Wizard's Crown 'Word Attack 'Word Maze •World 
Karate Championship •Rings of Zilfin •Zorro 

NEW! NEW! NEW! NEW! NEW! NEW! 

Volume 4 of the Super IOB collection covers all the controllers from 
COMPUTIST No. 54 through No. 65. The folbwing controllers are on 
volume 4: 

Abracadata/Design Home •Algebra 3 & 4 •American Challenge -Animate 
side (A) -AnimateskJe (B) -Applewriter Preboot -Aztec-Castle Wolfenstein 
-Champbnship Wrestling •Crossword Magic 4.0 -Crypt of Medea -Dam 
Busters •Dazzle Draw •Death Sword •Deathlord Scenark) •Digital 
Paintbrush Sys •Dondra^Dr Ruth 'Dreadnoughts 'Elem Social Studies #3 
•Elem Social Studies #6 •EOS/Arctk: Fox •Estimation •Fractkxi Factory 
•Fractions •General Chemistry #8 'Gl Joe 'Hardball 'Lords of Conquest 
•Matchmaker WGF •Math Blaster •Maxwell Manor •MECC (Apr 89) 
•Mkrozine #26 'Mind Over Matter (1984) •Nightmare Gallery •One on 
One (new) •Path Tactics •Penguin •Pitfall II 'Pool 1.5 'Print Shop Data 
Disk 'Project Space Statkjn 'PSAT Word Attack Skills 'Realm of 
Impossibility 'Roadwar 2000 ^Science Prof 'Science Toolkit Modules 
'Science Toolkit 'Seaspeller •Songwriter •Space Statnn •Spell It •Spy 
Hunter •Sunburst 'Super SunTGen Manager 'Super Sunday 'Teachers 
Rec Book 'Tellstar II 'Test Maker 'The New Oregon Trail 'Troll Shop Right 
'Ultima V (a) 'Ultima V (b) •Ultima V (c) •Vocabulary Adv I • Zilfin • 



Book of Softkeys 



D volume I D volume n D volume DI 
Check the box(s) for the book(s) you want then: 



US/Mexico 


Canada 


Foreign 


add $1 per book 




postage 


postage 


plus $.65 handling 


One Book $1.85 


$2.28 


$5.55 


plus the correct postage 


Two Books $2.40 


$3.70 


9.19 




Three Books $2.40 


$4.32 


12.83 


to get final cost... 



.^ 



The Super IOB Collection : includes all four disks with Super IOB version 1 .5, COM- 
PUTIST #32, PLUS a reprint of "Disk Inspection and the Use of Super IOB". 

D US/Canada/Mexico - All four volumes $30.00 $ ^_ 

D Other Foreign - All four volumes $35.00 $ 

D US/Canada/Mexico - Volume #4 only $8.00 $ 

n Other Foreign - Volume #4 only $10.00 $ 

Total enclosed... $ 



City 



-Zip- 



Camay _ 

VISA 

MC 

Sii^ifttim 



^PboiiD _ 



. EiT.- 



'Send US fiinds drawnon US bank. ' We ship by UPS so we need a street address. Otherwise, we 
ship by 1st Class mail which gets there but takes a little longer. ' Call (206) 832-3055 to use a 
credit card or send checkAnoney order to: 

COMPUTIST 33821 E Orville Rd Eatonville WA 98328 



